EverAttach Privacy Policy

Your files are yours. We do not sell your data, use it for advertising, or use your files and prompts to train AI.

Last updated: 12 October 2026

1. Who we are and what this policy covers

EverAttach ("we", "us", or "our") provides the EverAttach for ChatGPT Chrome extension, its public pages, account sign-in, and temporary file-sharing service. This policy explains the information these services access, collect, use, store, and share. The EverAttach developer is responsible for the processing described here and can be contacted at everattachapp@gmail.com.

EverAttach is independent of OpenAI and Google. It shares files through temporary links and does not change ChatGPT's native upload limits. OpenAI controls processing within your ChatGPT account under its own terms and privacy policy.

2. Information we access and collect

Account and authentication information

When you create an account or sign in, Supabase Auth processes your email address, account ID, authentication records, and session tokens. For email/password sign-in, credentials are submitted to Supabase Auth for verification; EverAttach does not maintain a separate plaintext-password database. Google sign-in requests only openid, email, and profile scopes. Google and Supabase may provide your name, email, profile image, and provider identifier as basic account metadata. We do not request Gmail, Google Drive, calendar, or contacts access.

Files you choose to upload

EverAttach receives the contents of files you explicitly select, or paste into the ChatGPT composer while EverAttach file paste is enabled. These may include documents, images, spreadsheets, source code, email files, or other supported files, and may contain personal or sensitive information you choose to share. We record file name, type, size, file ID, owner ID, storage object key, upload time, expiry, and deletion status. We also record hashed link tokens and their creation time, and account upload totals for fair-use limits.

ChatGPT content handled in your browser

The extension accesses the current composer to preview and insert selected file links and the instructions accompanying them. It examines displayed user-message content to render shared-file cards. This processing happens in your browser. Your prompt text and ChatGPT conversation history are not sent to the EverAttach backend for storage. When you send a message, ChatGPT receives the prompt and links through your own ChatGPT session.

Local settings and usage state

Chrome extension local storage holds your sign-in session, default file lifetime, file-paste preference, onboarding state, and review-reminder state. Review-reminder state includes a count of successful sharing actions and your reminder choices. These counters are local; we do not send them to an analytics service or use them to track your browsing. Draft selection and upload progress are held in browser memory while the page is open.

Technical requests and support

Our hosting and authentication providers may process IP addresses, browser/user-agent information, request URLs, timestamps, response/error status, and authentication or security events to deliver and protect the service. Requested file URLs contain access tokens, so infrastructure processing can include those URLs. The application does not intentionally log file contents or full prompt text. If you email support, we receive the address, message, and any attachments you voluntarily include; our support email is hosted by Google Gmail.

3. How we use information

• Identify your account, maintain sign-in, and authorize access to your own library.
• Upload, validate file format and size, store, list, preview, and retrieve the files you select.
• Create temporary links, insert them into your chosen ChatGPT message, and revoke access on expiry or deletion.
• Enforce upload capacity limits, prevent abuse, and maintain service reliability and security.
• Remember settings and display local onboarding or review reminders.
• Respond to requests you send to support and meet applicable legal obligations.

We do not use uploaded files, prompts, or account information for behavioral advertising, profiling, creditworthiness, lending decisions, or our own AI/model training.

4. Where information is stored and how it is protected

• Cloudflare R2: stores uploaded file bytes in a private bucket.
• Cloudflare D1: stores file metadata, hashed link tokens, and rolling upload-usage records.
• Cloudflare Workers: processes upload, library, link retrieval, deletion, and scheduled cleanup requests.
• Supabase Auth: stores account and authentication records.
• Your browser: stores extension settings and authentication sessions using local Chrome extension storage, rather than the extension's Chrome Sync storage.
• Support email: stores correspondence you send to our Gmail support inbox.

Requests use HTTPS. Library operations require authentication and check file ownership. Link access requires a randomly generated token; the database stores a SHA-256 hash instead of the original link token. Files are served with controls intended to prevent uploaded source code from executing as application code.

A private storage bucket does not mean end-to-end encryption. The service must process file bytes to store and deliver them. We use reasonable safeguards, but cannot guarantee absolute security of a browser, online service, or third-party provider.

5. Data sharing and service providers

We do not sell, rent, or trade user data. We disclose information only for the functions described here, user-directed sharing, necessary security operations, or legal obligations.

• Cloudflare: receives uploaded files, file metadata, link requests, and technical request information to host and operate the file-sharing service. Cloudflare privacy policy.
• Supabase: processes account information, credentials, authentication tokens, and sign-in events to provide authentication. Our Worker sends the access token to Supabase to verify the account for library operations. Supabase privacy policy.
• Google: handles Google sign-in if you choose it and supplies basic account information to Supabase; Gmail handles messages you send to support. Google privacy policy.
• OpenAI / ChatGPT: receives the message and temporary links you submit and may retrieve linked file contents. This sharing occurs when you choose to send the message; OpenAI's retention and use depend on its policies and your account settings. OpenAI privacy policy.
• Recipients you choose: anyone you give the complete temporary link to can retrieve the file while it is active.

Providers may process information in different countries and maintain their own operational records. Their policies govern their independent processing. We do not transfer data to advertising networks or data brokers. Other disclosure is limited to a valid legal requirement or necessary investigation of fraud, malware, or abuse. A transfer in a merger, acquisition, or asset sale would require the user's explicit prior consent where required by the Chrome Web Store Limited Use rules.

6. Temporary links and your private library

Other users cannot browse your account's library through the authenticated library interface. However, a shared file link is a bearer link: anyone with the complete URL can open that file without signing in. It is not restricted to ChatGPT or your account. Links do not include your email address, but the file name and contents may identify you.

Keep links private unless you intend to share them. Do not post a link publicly if its file is confidential. ChatGPT, a recipient, browser history, or a copied message may retain the URL. Expiry and deletion stop future access through EverAttach; they cannot erase copies already obtained.

7. Human access to information

We do not routinely open, review, or read your uploaded files or prompts. Authorized personnel may access specific user information only with your explicit permission for support, when necessary to investigate security or abuse, or when required by law. Account and file metadata may be accessed as necessary to operate and protect the service. We do not claim that our infrastructure makes administrative access technically impossible.

8. Retention, expiry, and deletion

• Uploaded files and link metadata: new uploads expire after your chosen duration, from 10 minutes to a maximum of 24 hours. Expired links are blocked immediately. Cleanup is scheduled every 15 minutes to remove expired/deleted objects and metadata, in batches; backlogs, errors, or provider outages may delay physical removal.
• Manual deletion: deleting a file in your library revokes all its links immediately. The service attempts physical deletion at once and retries through scheduled cleanup if needed. Removing a card from a draft is not the same as deleting the stored file from your library.
• Upload-usage records: records enforce a rolling 24-hour allowance and are removed by scheduled cleanup after that window.
• Accounts: account and authentication records remain while your account exists. Request account deletion by emailing support from your account email. We may need to verify ownership before acting.
• Local browser data: retained until you sign out, reset or clear the relevant extension data, or uninstall. Signing out clears the extension's active session; it does not delete your account or uploaded files.
• Support and provider records: kept as needed to resolve requests, secure the service, and meet legal obligations. Infrastructure providers may retain authentication/security logs or backup records under their own policies. We do not promise immediate erasure from provider backups or records outside our control.

Uninstalling does not delete your server account. Remaining uploaded files still expire automatically. ChatGPT messages, recipient downloads, and information already processed by third parties must be managed with those services directly.

9. Your choices and privacy requests

You can choose which files to share, preview the outgoing message, select expiry, reuse active files, delete files from your library, disable EverAttach file paste, sign out, or uninstall the extension. File paste is enabled by default for file clipboard data in the ChatGPT composer; switch it off in the EverAttach menu to use ChatGPT's native file-paste behavior. The extension does not continuously monitor your clipboard or read it outside a paste action.

For access, correction, account deletion, or other applicable privacy rights, email everattachapp@gmail.com from your account address and describe your request. You may request a copy of account/file metadata we hold and download active files before expiry. We verify requests to protect other users and explain any legal retention requirement. Depending on your location, you may also have rights to object, restrict processing, withdraw applicable consent, or complain to a data-protection authority. Withdrawing Google authorization does not itself erase an EverAttach account.

10. Chrome permissions and access

• storage: remembers local sessions, preferences, onboarding, and review-reminder state.
• identity: completes the Google sign-in flow and extension callback.
• chatgpt.com: adds the composer controls and file cards, processes your chosen outgoing links and enabled file-paste actions, and displays sent-file cards.
• EverAttach API host: uploads selected files, lists your library, issues links, retrieves previews, and deletes files.
• Supabase authentication host: handles sign-in, account verification, and session refresh.

EverAttach does not request broad access to all websites, browsing history, bookmarks, or browser cookies. It does not collect unrelated website content, continuously record keystrokes, or extract your ChatGPT password/session cookies.

11. Cookies, analytics, and advertising

The extension and EverAttach's public homepage/privacy page contain no advertising trackers, analytics scripts, or behavioral advertising pixels. We do not use local review counters for remote analytics. Authentication relies on the extension's stored Supabase session. Google sign-in, ChatGPT, and provider-hosted pages may use their own cookies and technologies under their policies. Essential infrastructure request/security records are distinct from advertising tracking.

12. Limited Use commitment

EverAttach's use and transfer of user data comply with the Chrome Web Store User Data Policy, including the Limited Use requirements. Information received from Google APIs is used only to provide or improve the disclosed sign-in and file-sharing service. We limit transfers and human access to the permitted purposes described in this policy. We do not use or transfer this information for personalized advertising, data-broker sales, creditworthiness, or lending.

13. Children and sensitive files

EverAttach is not intended for children under 13, or below the minimum age required for the services they use. If you believe a child supplied personal information without appropriate authorization, contact us so we can investigate and address it. Share only files you are entitled to share and consider whether temporary bearer links are appropriate for highly sensitive information.

14. Changes to this policy

We will update this page and its last-updated date when our practices change. Material changes in how the extension handles user data will also be disclosed in the product before the new handling begins, with consent requested where required. Publishing an updated policy alone is not a substitute for consent where consent is required.

15. Contact

For privacy questions, file deletion assistance, or account requests, contact the EverAttach developer at everattachapp@gmail.com. Include the account email and enough information to identify your request; do not send passwords, authentication tokens, or confidential file links unless specifically needed and requested.