Frogpost

Privacy Policy

Effective November 8, 2026 · Terms of Service

Frogpost is a Chrome extension that turns an AI chat or email thread into a handoff and drops it into the next chat box. It is made by GhostEngine LLC, a Wyoming limited liability company ("GhostEngine", "we", "us"). This policy explains what Frogpost reads, where it goes, how long it's kept and what you control. It covers the extension, our server, the phone page and frogpost.app.

The short version

Frogpost reads a chat when you grab it, and keeps an on-device summary of chats you have open. On Claude, ChatGPT and Gemini, when Chrome's built-in AI is available, Frogpost reads the open chat in the background and summarizes it on your computer, so a grab is instant. With Remember my chats (on unless you turn it off), those summaries are also saved to your library as you go. Neither sends anything anywhere unless you're on Pro with sync on, and you can turn either off for any site.
Your library lives in your browser. It reaches our server only if you're on Pro with sync on (on unless you turn it off, because syncing and searching your library is what Pro is).
We never store or log your chats. When our server writes a handoff, the chat passes through it to Anthropic and back, and nothing is kept.
Secrets are hidden before a chat leaves your browser. API keys, tokens, emails and phone numbers are swapped for placeholders, and your device puts them back in the handoff. Names and addresses are not caught.
Phone links are end-to-end encrypted. We relay ciphertext we can't read.
Accounts are optional, and there are no ads or tracking cookies. If you sign in, with Google or an emailed code, we keep only your email address. We count how often Frogpost is used (numbers only, never text, under a random ID), and you can turn that off. In the EU and EEA it is off unless you turn it on. We don't sell or share your data, and nobody trains AI models on it.
Delete everything in one click, on your device and on our server, from Settings → Your data.

1. What we process and why

Accounts are optional. Frogpost makes a random license key when you install it (not tied to your name or email), and that key is how our server tells installs apart. If you sign in, with Google or an emailed code, we also keep your email address so your purchases and settings follow you to other browsers.

Data	Where it is	Why	How long
Chats you grab: the conversation, email thread, document or selection on the tab you grab	Your device. Sent to the AI that writes the handoff (section 2)	To write the handoff you asked for	Kept on your device with the handoff it made (the newest 50 chats). Never synced and never stored on our server
Open chats on Claude, ChatGPT and Gemini (only when Chrome's built-in AI is available)	Your device only. Read and summarized by Chrome's built-in AI	So a grab is instant, and, unless you turn off Remember my chats, to keep each chat's handoff in your library	The summary lasts while the tab is open. Remembered handoffs stay until you delete them
Handoff library: handoffs, their title, source page address, time and project name	Your device (free: newest 50; Pro: all), including handoffs saved by Remember my chats. Our server too, on Pro with sync on	So you can find and reuse past work, on all your devices and in AI tools you connect over MCP	Until you delete them
MCP link (Pro): a random link that lets AI tools you connect read and save your handoffs	Your device. Our server keeps only a scrambled form (hash) of it, tied to your license key	So connected AI tools can reach your library without your license key	Until you make a new MCP link in Settings (the old one stops working) or Delete everything
Search queries (Pro sync)	Sent to Voyage AI to search by meaning	To find handoffs by meaning	Not stored by us
Settings and your own API key	Your device only. Never synced, never sent to us	To run Frogpost the way you set it	Until you change them or uninstall
License key	Your device. Our server when you use hosted handoffs, Pro or purchases	To apply your plan and limits	While you use Frogpost
Account (only if you sign in): your email address, the license keys of the browsers you signed in on, and which frog you picked. With Google we receive your email address only. A sign-in code is kept only as a scrambled hash for 10 minutes	Our server. Codes are emailed through Resend	So Pro, rare frogs, your frog and your synced library follow you to every browser you sign in on	Until you delete everything or ask us to delete it
Subscription and purchases: Stripe customer and subscription IDs, status, rare frogs bought	Our server. Payment details are with Stripe, which also prints your license key on your invoices and receipts so you can find it again	To run Pro and unlock what you bought	While active, then as tax and accounting law requires
Usage counters: hosted handoffs per license key, free ones per IP address (per /64 network on IPv6), and hosted AI cost per license key per month	Our server	To enforce daily and monthly limits and prevent abuse	Daily counts: 2 days. Monthly cost: 40 days
Usage counts: how many grabs, drops, phone sends, library searches, reuses and remembered chats a day, under a random install ID that is not your license key; how often a phone page is opened, under a scrambled form of its link's channel. Numbers only, never any text	Our server	To learn whether people keep using Frogpost and which parts they use (legitimate interests; in the EU and EEA, your consent: off until you turn it on)	Until you delete them. Turn them off in Settings → Your data; Delete everything removes them
Uninstall survey (only if you answer it): the reason you tap and, if you type one, a short note. No install ID, license key or IP address comes with it	Our server	To learn why people leave and fix it	Counts per reason per day: until we delete them. Notes: 90 days
Encrypted phone handoffs, and an encrypted copy of your newest saved handoffs for the phone's Library and Projects	Our server, as ciphertext only	To deliver handoffs and your library to your paired phone	Each handoff is deleted 7 days after it was sent (newest 20 kept). The library copy is replaced whenever your library changes and deleted 7 days after the last change. New code or Delete everything deletes both at once
Connection data: IP address, browser and device type	Cloudflare (our server) and Lovable (frogpost.app), when you connect	To deliver pages and requests securely	Hosts keep short-lived security logs under their policies
Service logs: which of our addresses was called (with license keys and phone channels cut out), the status code, how long it took, and counts of errors and AI cost per hour. No chat text, no license key, no IP address	Our server (Cloudflare Workers Logs)	To notice and fix outages, failed payments and runaway cost	Logs: 3 days (7 on Cloudflare's paid plan). Hourly counts: 2 days
Emails you send us	Our inbox	To answer you	As long as needed to help you

Our legal bases under the GDPR: contract for handoffs, sync, phone delivery and your subscription; legitimate interests for limits, abuse prevention, security and usage counts outside the EU and EEA; consent for usage counts in the EU and EEA, which you can withdraw any time with the switch in Settings; legal obligation for tax records.

2. Where a chat goes when you grab it

Frogpost uses the first writer available, and after every grab the frog tells you which one wrote it:

Your own API key. The chat goes from your browser straight to Anthropic or OpenAI under your own account and their terms. It never touches our server.
Chrome's built-in AI. The chat never leaves your device.
Our server (a free daily allowance, or Pro). The chat goes to our server on Cloudflare, which sends it to Anthropic's API and streams the handoff back to you as it is written. On Pro, a second Claude model then checks the handoff against the same chat and names lines to fix, also through Anthropic. Before the chat leaves your browser, Frogpost replaces API keys, tokens, emails, phone numbers and similar identifiers (such as card numbers) with placeholders such as [key-1], and puts the real values back on your device when the handoff returns, so neither we nor Anthropic see them. This catches those patterns only: names, street addresses and anything else in the chat are sent as written. Neither the chat nor the handoff is stored or logged. Under its commercial terms Anthropic does not train on this data and deletes it within 30 days, unless it is flagged for a usage-policy review.
Offline builder. If none of these is available, Frogpost builds the handoff on your device.

Background summaries. On Claude, ChatGPT and Gemini, if Chrome's built-in AI is already available on your computer, Frogpost reads the chat you have open after each reply and folds it into a running summary, written by that on-device AI, so a grab can hand it over at once. It pauses while the tab is hidden and on low battery. The chat and the summary stay on your device. Remember my chats (on by default, everywhere, because it stays on your device; turn it off in Settings, Your data) also saves that summary to your library as the chat grows, one entry per chat, without a grab. Remembered handoffs are handled like any other: on your device, and on our server only if Pro sync is on.

Drafted replies in Gmail and Slack. When you click into an empty reply box in Gmail or an empty message box in Slack, the frog offers to draft a reply. Only if you say yes does Frogpost read that email thread or Slack conversation, and it goes to the same writer as a grab (above). The draft fills the box and stops there: Frogpost never sends an email or a Slack message. Your "My names" setting, which tells Frogpost which messages are yours, stays on your device.

On Claude and ChatGPT, a grab may load the full conversation from that site's servers using the session you're already signed in with. That request goes from your browser to the site, not to us. A chat or email can contain other people's personal data. Frogpost processes it only to make the handoff you asked for.

3. Phone links

When you pair a phone, Frogpost encrypts each handoff on your computer with AES-256-GCM. The key is in the part of the QR link after "#", which browsers never send to a server, and the phone page keeps it in that phone's browser storage. Our server stores only the encrypted copies, so we can't read them. Anyone who has the link can, though, so treat it like a password. New code in Settings unpairs the old phone and deletes what it could still fetch.

A paired phone also gets your newest saved handoffs (as many as fit in one message), encrypted the same way, so it can show your Library and Projects. When you send a handoff to the phone, Frogpost also writes a short text message and an email draft from the same chat, with the AI you chose for handoffs, so the phone's Messages and Mail buttons open with the right version. In hosted mode that is one more trip through our server and Anthropic, counted like a handoff.

4. What we never do

Read pages beyond what this policy describes, or read your browsing history, passwords or form fields. Frogpost needs access to all sites so it can work in any chat box, but outside a grab it reads only open chats on Claude, ChatGPT and Gemini for the on-device summary, and notices when you click into a text box while you carry a handoff, or into a reply box in Gmail or Slack (to offer a draft).
Send a message for you. Frogpost fills the box, including the Gmail and Slack replies it drafts, and you press send.
Log chat or handoff text, or put it in analytics or error reports.
Sell or rent personal data, or share it for advertising.
Train AI models on your data, or let our providers do so.
Read your data ourselves, unless you ask us to for support, security requires it, or the law does.

5. Service providers

These companies process data for us, only to run Frogpost and under contracts that restrict them to that. We'll update this list before adding a new one.

Provider	Purpose	Data	Location
Cloudflare	Hosting: Workers, D1, KV, Vectorize, Durable Objects	License key, account email (if you sign in), counters, usage counts, subscription status, synced library, encrypted phone handoffs, connection data	Global, US company
Anthropic	Writes hosted handoffs (Claude)	Chat text from hosted grabs	US
Voyage AI	Search by meaning (Pro sync)	Synced handoff text, search queries	US
Google	Sign in with Google (only if you choose it)	Confirms your email address to us	US
Resend	Sends email sign-in codes (only if you choose it)	Your email address and the code	US
Stripe	Payments and billing portal	Payment details, email, billing address, license key	US
Lovable	Hosts frogpost.app	Website connection data	Sweden, EU

If you use your own API key, your chat goes to Anthropic or OpenAI under your agreement with them, not ours. We may disclose data if the law requires it, to protect people's safety or our rights, or to a successor if GhostEngine or Frogpost is sold, and this policy keeps applying to it.

6. Your controls

Delete everything (Settings → Your data) removes your library and the handoff you're carrying from this device. It also removes every synced handoff, search index entry, encrypted phone copy and usage count from our server, and your account's email address (what you bought stays with this browser's license key). Your other synced devices delete their copies on their next sync.
Send usage counts is on by default, except in the EU and EEA, where it is off until you turn it on. Frogpost treats a computer set to a European time zone as being in Europe, and our server keeps counts from an EU or EEA connection only if you turned the switch on. Phone page opens from an EU or EEA connection are never counted. Turn it off and nothing is counted from then on.
Never read these sites: list sites where Frogpost must not grab, draft replies or write background summaries.
Remember my chats is on by default. It saves only to your device (and to our server only on Pro with sync on). Turn it off in Settings, Your data.
Sync is on with Pro, and off on the free plan. Turn it off in Settings and your library stays in your browser. Delete any handoff and it's deleted from our server too, and from your other synced devices on their next sync, along with the chat it came from.
Keep chats off our server by using your own API key or Chrome's built-in AI.
Uninstall to remove everything Frogpost keeps on your device.
To delete your license and purchase record too, cancel any subscription in the billing portal and email us your license key (it's on the Settings page). We'll delete it within 30 days, except records the law requires us to keep.

7. Your privacy rights

Everyone. You can ask us to access, correct, export or delete your data, or to stop processing it. Email zoltan@frogpost.app with your license key or the email address you signed in with, because that is how we find your data. We'll reply within 30 days. If you ask, we won't charge you or treat you differently.

EEA, UK and Switzerland. You also have the right to object to processing based on legitimate interests, to restrict processing, and to lodge a complaint with your data protection authority. GhostEngine is the controller.

California and other US states. In the past 12 months we collected identifiers (license key, IP address, and your email address if you sign in), commercial information (purchases) and the content you chose to grab, for the purposes in section 1, from you and your device. We don't sell or share personal information as the CCPA/CPRA defines those terms, and we don't use sensitive personal information to infer anything about you. So there is nothing to opt out of, and we honor Global Privacy Control by default. You can use an authorized agent. We'll reply to California requests within 45 days.

8. International transfers

We and most of our providers are in the United States. When EU, UK or Swiss data is transferred, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

9. Security

All traffic uses HTTPS. Phone handoffs are end-to-end encrypted, payment cards never reach our servers, and our server stores the minimum listed above. Your license key unlocks your Pro library and billing, so keep it private; it never goes in the MCP link. The MCP link gives an AI tool access to your handoffs: if it leaks, make a new one in Settings and the old one stops working. No system is perfectly secure. If a breach affects your data, we'll notify you and the authorities as the law requires.

10. Children

Frogpost is for adults. You must be 18 or older to use it. We don't knowingly process children's data. If you believe a child has used Frogpost, email us and we'll delete what we hold.

11. Cookies

Frogpost and our server set no cookies and use no third-party analytics or tracking. The extension keeps its data, including the random install ID for usage counts (section 1), in Chrome's extension storage, and the phone page keeps its pairing key in the phone's browser storage. Stripe sets its own cookies on its checkout and billing pages. frogpost.app sets no cookies and loads no trackers. If that changes, we'll ask your consent first.

12. Chrome Web Store disclosure

Frogpost's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use data only to provide Frogpost's single purpose: grabbing, writing, keeping and dropping handoffs, and to improve it (usage counts, which hold no content). We never transfer it for advertising, credit decisions or data brokering, and humans don't read it except as described in section 4. The identity permission is used only for Sign in with Google, and we receive only your email address from it.

13. Changes

When we update this policy we change the date at the top. For a material change, we'll give notice before it takes effect, for example in the extension.

14. Contact

Questions or requests: zoltan@frogpost.app
Mail: GhostEngine LLC, 390 NE 191st St STE 17348, Miami, FL 33179, United States