Privacy Policy

Last updated November 3, 2026.

AppCaddy makes small browser tools. This policy explains what each one does and does not do with your data. It covers the AppCaddy suite and the standalone tools: NoBait, QuickerTicker, MeetMark, WhichCard, WatchPost, PagePulse, LinkLasso, and DarkPatch, plus CardClip and CookieCall, which ship switched off while they are in development. It also covers PinPoints, the hotel points map at pinpoints.appcaddy.io.

The short version

• No account. You never sign up or log in.
• No ads. The extensions show no offers and no promotions.
• PinPoints is the one product whose links may earn a commission. Its section below explains how.
• We do not sell, rent, or share your data with anyone.
• Each tool stores its settings and data in your own browser. You can export, import, or wipe that data at any time.
• Where a tool sends anything, its section below says what goes where.

What each tool does with data

PagePulse

Your interval settings and each tab's timer state are stored in your browser. The feedback form is described under Feedback reports below.

MeetMark

Screenshots, page text, and transcripts are built on your device and saved where you choose. Your preferences are stored in your browser. The feedback form is described under Feedback reports below.

WhichCard

WhichCard never sees or stores a full card number. A card is identified only by the SHA-256 hash of the last four or five digits you enter. Your card nicknames, those hashes, and your preferences are stored in your browser's storage. If your browser has settings sync turned on, that data rides your own browser account's sync, the same way your bookmarks do. It does not pass through any AppCaddy server. If you turn on the optional CVV field, that value is stored with your cards and syncs the same way, so enable it only on a browser you alone use. A PIN, if you set one, is stored on your device only and never syncs. The feedback form is described under Feedback reports below.

WatchPost

Your monitors, baseline snapshots, and history are stored on your device. Outbound requests go only to the pages you choose to monitor, to any Discord, Slack, webhook, or email relay endpoint you set up yourself, and to the optional feedback form (see Feedback reports below). An exported backup file includes any webhook URL and relay credentials you saved, so keep that file private.

QuickerTicker

Your watchlist and settings are stored locally. To show prices, charts, and news, QuickerTicker fetches data using the ticker symbols on your list from Yahoo Finance, with Stooq as a backup. If you turn on the optional AI move summary, only the ticker symbol and asset name are sent to the AppCaddy summary relay, which passes them to OpenAI to write the text. OpenAI does not train on them. Your headlines are fetched locally for display and are not sent. If you enter your own Finnhub API key, it is stored locally and sent only to Finnhub.

NoBait

NoBait fetches the link you hold, and each redirect, the same way a click would. Every hold-click sends the link's headline and up to 6,000 characters of its article text to the AppCaddy relay at no-bait-ai-proxy.appcaddyio.workers.dev. When the article cannot be read, it sends the headline, the link, the site name and the publish date when known instead. The relay passes the text to OpenAI to write the answer. OpenAI does not train on it and may keep it for up to 30 days for abuse checks. The relay keeps no copy. If you turn on Ask Gemini or Ask Claude in the settings, pressing that button in the tooltip sends the same headline and article text through the relay to Google or Anthropic, which write a second answer under their API data terms. It sees your IP address and uses it only to limit request rates. If a page will not load directly, NoBait opens it in a background tab in your own browser, reads it, then closes the tab. When you press a fallback button in the tooltip, or set one to run on its own, NoBait contacts the service that button names. Jina Reader sends the link to r.jina.ai, Try archive sends it to the Wayback Machine, and Archive.today sends it to archive.today. Alt source sends the headline to Google News and DuckDuckGo. Your settings and excluded sites stay in your browser.

No API key is stored in the extension. The feedback form, and the Report an issue button in the tooltip, are described under Feedback reports below.

LinkLasso

The links you select with a drag are handled by your browser. It opens the tabs, puts the copy on your own clipboard, and saves the bookmark. Your gesture and action preferences, and a short record of your last selection so the panel can show it, are stored in your browser. The feedback form is described under Feedback reports below.

DarkPatch

DarkPatch reads the styles of the page you are on and rewrites their colors before the page paints. Your mode, site lists, per-site settings, and fixes are stored in your browser. Stylesheets and small background images the page loads from other sites are fetched by the extension with the same access the page already has, and cached only for the session. The feedback form is described under Feedback reports below.

CardClip and CookieCall

Both ship inside the suite but stay switched off while they are in development. They appear in Preferences marked as in development with no toggle, and none of their code runs. This policy will describe each of them before either is switched on.

PinPoints

PinPoints is a website, not an extension. It loads its own hotel data from pinpoints.appcaddy.io and its map tiles from OpenFreeMap. It has no account and no ads, and it does not sell data. It stores your light or dark choice in your browser. When you switch a hotel card to Cash, PinPoints asks the AppCaddy price service at pinpoints-prices.appcaddyio.workers.dev for that hotel's price. It sends the hotel's name, location, city and country and the dates you chose, and nothing about you. The service asks DataForSEO, which reads prices from Google Hotels, keeps the answer for a day, and does not store your IP address.

PinPoints also records how the map is used, so AppCaddy can see which features people use and where they stop. As you use it, the page sends AppCaddy's own service at pinpoints-pixel.appcaddyio.workers.dev a short record of each step: the searches you pick, the hotels you open, the dates you choose, the Points or Cash switch, the details and circled-i panels you open, the booking buttons you press, where the map settles, and how long the page was open. Each record carries the PinPoints version, your browser's language, whether you are on a phone, the site that sent you, and the country, region and city Cloudflare reads from your connection. Your IP address is used only to limit how often one connection can send, and is never stored. Each visit gets a random number that exists only while the tab is open.

PinPoints can also keep a random number in your browser so your later visits join the same history. It reads which country you are in from your connection. Outside the EU, the EEA, the UK and Switzerland it keeps one, and a one-line note on your first visit says so. In those countries it asks first and keeps one only if you choose Allow; your answer is saved in your browser so you are asked once. The number is not tied to your name, your email or any account, and PinPoints never makes one when your browser sends a Global Privacy Control signal. To stop it, choose Forget this browser at the bottom of the map (on a phone, at the bottom of the program list). That deletes the number and every record kept under it, and no new one is made in that browser. Clearing the site's data in your browser removes the number too. Records are kept for 13 months and are not sold or shared with anyone. If that changes, this section will say so before it happens.

Notice at collection for US residents. PinPoints' usage records hold identifiers (the random visit and browser numbers), internet activity (what you do on the map and the site that sent you there) and approximate location (the country, region and city read from your connection). They are used to understand and improve PinPoints, kept for 13 months, not sold or shared, and not used for targeted advertising. PinPoints collects no sensitive personal information. Your rights are under US state privacy rights below.

The booking button opens the hotel chain's own website. Some booking buttons may carry an affiliate code, which lets AppCaddy earn a commission if you book a cash stay, at no extra cost to you. Bookings made with points earn nothing, and the code never changes the price you see or the hotels the map shows.

The AppCaddy suite

The suite runs the tools above inside one extension, and each tool behaves exactly as described. Only the tools you switch on can do anything. Because NoBait can read page content, the suite declares website content data collection to the browser.

Feedback reports

Every tool has an optional Send feedback control. A report contains the short message you type, a diagnostic summary the form shows you in full before you send (recent steps in the tool, recent errors, version, browser), and up to three screenshots if you choose to attach them. It is sent to the AppCaddy feedback service, a Cloudflare worker that files the report as an issue in a private AppCaddy repository. Nothing is sent until you press Send, and reports are rate limited. NoBait's in-tooltip "Report an issue" panel uses the same service.

Third-party services

PinPoints' price service and its usage records run on Cloudflare. The price service passes hotel and date queries to DataForSEO; the map tiles come from OpenFreeMap. Both operate under their own policies.

AppCaddy runs relay workers on Cloudflare for NoBait answers and the optional QuickerTicker summaries. These relays hold the OpenAI API key so it never ships in the extension, pass your request to OpenAI, and return the result. They are not used to profile you and do not require an account. The public services NoBait may contact to resolve a blocked link (listed above) are operated by their own providers under their own policies.

Ads and affiliate links

AppCaddy extensions contain no ads, no offers, and no affiliate links, and they make no offer-related network requests. Each tool has a Support button that opens plain links to our donation options and to appcaddy.io/contribute; you can hide the button with its own toggle. This website has no referral or affiliate links. PinPoints shows no ads; its booking buttons may carry affiliate codes, as its section above describes.

Data you can control

Each tool lets you export a full backup, import one, or wipe all of its data from your browser. Uninstalling a tool removes its local data.

US state privacy rights

If you live in a US state with a consumer privacy law, such as California, Virginia, Colorado, Connecticut, Texas or Oregon, you can ask what personal information we hold about you, get a copy, have it corrected or deleted, and opt out of its sale, its sharing for cross-context behavioral advertising, and its use for targeted advertising. AppCaddy does none of those three, and treats a Global Privacy Control signal from your browser as an opt-out.

PinPoints' usage records carry a random number, not your name or email. Forget this browser in PinPoints deletes that number and every record kept under it straight away. For anything else, including a feedback report you sent, email hello@appcaddy.io. We answer within 45 days, may ask for details that let us find your records, and will not treat you differently for asking. Someone you authorize can make a request for you. If we turn a request down, reply to that email to appeal, and we will answer the appeal within 60 days.

Children

AppCaddy tools are general-purpose utilities and are not directed at children.

Changes

If a tool's data behavior changes, this policy is updated and the date above changes. Where a store requires it, a change to what a tool collects is also disclosed in the extension before it takes effect.

Contact

Questions about this policy: hello@appcaddy.io.