ClipHutch Privacy Policy

ClipHutch is a Chrome extension that detects video and still-image URLs as web pages load them, shows local previews for direct media files in its popup or side-panel workspace, and lets you download direct files or supported HLS/DASH streams. For streams that deliver audio and video as separate tracks, the extension fetches both and combines them into one MP4, and segments in the MPEG-TS format are repackaged into MP4. WebM direct files are converted locally to MP4 before saving. A normal Capture Pack also saves a required redacted _cliphutch-manifest.json after its media jobs finish; an optional CSV is saved only when you select CSV. Quick Capture does not create a manifest. Detection, preview display, conversion, manifest creation, and downloading happen on your device. The extension does not run analytics. A lightweight content script reads image URL attributes from the current page so still images can be detected even when a network event was missed. The free tier never contacts a ClipHutch-operated server. The paid tier contacts ClipHutch's license service when you activate or deactivate a license and when an existing activation needs a status refresh (see "What leaves your device" below). The technical sections below describe exactly what data the extension accesses and where it goes.

1. What this extension does

ClipHutch observes the network requests your browser makes on HTTP and HTTPS pages and identifies the ones that look like media files: direct video formats (.mp4, .webm, .mov, .m4v, .mkv, .ogv), still-image formats (.jpg, .jpeg, .png, .webp, .avif, .gif), HLS playlists (.m3u8), and DASH manifests (.mpd). It also scans image URL attributes already present in the page DOM so larger still images can appear in the toolbar count without requiring you to click each image first. Small still images under 100KB, or obviously tiny DOM images, are hidden to avoid page icons and tiny UI assets. When ClipHutch's popup or side-panel workspace shows a direct media preview, that preview loads from the original source URL. When you click Download in either interface, the extension either hands the file to Chrome's download manager, converts WebM direct files locally to MP4, or assembles stream segments locally into a playable MP4 file for supported HLS and DASH streams. For streams whose audio and video are delivered as separate tracks, it also fetches the matching audio rendition (a URL taken from the stream manifest) and combines it with the video. Some streams store their segments as byte ranges of a larger file, so the extension may request specific byte ranges of a segment. Segments delivered in the MPEG-TS format are repackaged into MP4. All processing happens on your device.

For every normal Capture Pack, ClipHutch waits until all media jobs are complete, failed, cancelled, or otherwise terminal, then asks its packaged offscreen document to create a bounded local text Blob and uses Chrome's download manager to save _cliphutch-manifest.json during pack finalization. If you explicitly choose CSV, it also saves _cliphutch-manifest.csv from the same redacted records. Quick Capture does not create either manifest. The files are an intentional part of your download and remain in your Downloads storage until you delete them. One-shot alarms may recover unfinished delivery or Blob cleanup; this uses the existing permissions and adds no new permission.

2. What data it accesses

While you browse, the extension observes only the following data, and only on HTTP/HTTPS pages:

Network request URLs and a small number of response headers (content-type, content-length, content-disposition) for media-related requests (HTML/sub-frame/XHR/image/media/other request types). Segment requests for HLS streams are ignored at detection time.
A small set of request headers from the same media requests, specifically Referer, Origin, User-Agent, Authorization, and any X-* custom headers the page sent. The ordinary per-tab copy is held in browser session memory (chrome.storage.session) and cleared when the source tab navigates away or closes. If you add that media to Hutch, or if a stream or WebM conversion download needs the page's request headers, ClipHutch may copy only these approved headers into a separate, session-only item lease before the per-tab copy disappears. A lease is bound to the exact selected item, source tab, page, media URL, replay kind, source origin, and path; it lasts no more than 60 minutes. It can attach the headers only to extension-initiated XMLHttpRequest/other fetches within that source scope, such as HLS/DASH parts or a local WebM conversion fetch. It is never used for a preview, sent to a ClipHutch-operated server, written to disk, or included in a capture manifest. Direct media files handed to Chrome's download manager are fetched without header injection. A download's lease is released when that download finishes.
Image URLs from page markup, limited to image-related attributes such as src, srcset, currentSrc, and common preview-image meta tags. The content script uses these values only to add still-image candidates to ClipHutch's popup or side-panel workspace and toolbar badge.
The originating tab's URL and title, for any tab where the page loaded a media-shaped network request, used solely to associate detected media with the page it came from. This is not limited to the foreground tab; any tab that loads a media-shaped request while the extension is enabled has its URL and title read for that purpose.
The media/page snapshot and review/run context for items you explicitly select in Hutch. These records remain only in chrome.storage.session, so your selection and Activity state can survive source-tab navigation or close without becoming persistent browsing history.
A bounded, redacted Capture Pack manifest record. For each reviewed item this can contain its planned relative download path; the final basename, when Chrome reports one; media kind and bounded width, height, duration, or bitrate metadata when known; capture time and terminal status; a bounded public error category/message for failed or cancelled items; the source page URL after user information, query parameters, and fragments are removed; and only the source media host, never the media URL. It never contains captured headers, media URLs or signed queries, Blob URLs, license or installation data, quota or command IDs, raw internal errors, or absolute local paths.

The extension does not read form fields, text content, cookies, passwords, or private page data from the DOM.

3. Where data is stored

Data stored by the extension
Category	Storage area	Lifetime
Detected media (per tab)	`chrome.storage.session`	Cleared when the browser restarts, the extension reloads, the extension updates, or the browser closes. Cleared per-tab on top-level navigation or tab close.
Captured request headers (ordinary per-tab copy)	`chrome.storage.session`	Cleared per-tab on navigation or tab close, and on browser restart. Only approved headers for media you add to Hutch or a stream or WebM conversion download that needs page request headers may be copied into the separate bounded lease below.
Selected Hutch media/page snapshot and review/run context	`chrome.storage.session`	Remains available across source-tab navigation or close. Cleared on browser restart, extension reload/update, or Clear Hutch; removing an item clears its unconsumed selected-item data.
Selected-item replay-header leases	`chrome.storage.session`	Created only for media you add to Hutch or stream or WebM conversion downloads that need approved replay headers. Bound to the exact item/source scope, never used for previews, and never written to disk or sent to ClipHutch. Maximum lifetime: 60 minutes. An unconsumed Hutch lease is released on item removal or Clear Hutch; a download lease is released when that download finishes. Cleanup runs immediately when practical and is reconciled by a one-shot alarm or the next browser wake. Chrome may deliver an alarm late while the browser is asleep, but expired headers are not accepted for new work.
Download command and job records, including source URL, page/filename context, progress, and outcome	`chrome.storage.session`	Retained for the current browser session and cleared on browser restart, extension reload, or extension update.
Redacted Capture Pack manifest record and delivery status	`chrome.storage.session`	Created for normal Capture Packs so the required JSON, and optional customer-selected CSV, can be saved only after all media jobs are terminal and unfinished delivery can be recovered during the current browser session. Cleared on browser restart, extension reload, or extension update. Quick Capture does not create this record.
Temporary header-replay rules	Chrome session rules	Created only for a selected download with a valid header lease. Limited to extension-initiated XMLHttpRequest/other requests and the selected source's exact scheme, origin, and path scope. Removed when the owning job becomes terminal, the lease expires, cleanup reconciles on the next wake, or the browser session ends.
`_cliphutch-manifest.json` and optional `_cliphutch-manifest.csv`	Your Downloads storage, through Chrome's download manager	Intentionally saved as local Capture Pack artifacts after all media jobs are terminal. They remain on disk until you delete them. JSON is required for a normal Capture Pack; CSV is saved only when you opt in. Quick Capture creates neither file.
License state	`chrome.storage.local`	The key, activation/validation timestamps, activation generation, and pending deactivation retry ID remain until confirmed deactivation, local-only removal, or uninstall.
Installation UUID	`chrome.storage.local`	Retained until uninstall. Removing only the license key does not reset it.
License notices	`chrome.storage.local`	Retained until dismissed, successful reactivation, local-key removal, or uninstall.
Free-tier video download timestamps	`chrome.storage.local`	Entries older than 24 hours are pruned when quota is checked. Still-image downloads are not recorded.
User settings (filename template, HLS size cap, etc.)	`chrome.storage.local`	Persistent on your device until you uninstall the extension or click "Reset to defaults".

The extension does not use localStorage or sessionStorage.

4. What leaves your device

Free tier. The extension sends no license, usage, browsing, or media data to ClipHutch. Preview and download requests still go directly to the original source server.

Licensed tier. Your license key and a randomly generated installation UUID are sent to ClipHutch's license service, a Cloudflare Worker at https://cliphutch-api.mra454.workers.dev, under three conditions:

At activation, when you paste your license key into the Options page and choose Activate. This creates or refreshes this browser's activation.
Periodically, when you open the popup or side-panel workspace and the last successful check is at least seven days old, to refresh this existing activation. A status check cannot create a new device activation. If a check fails, the cached license remains active and ClipHutch may retry on a later interface opening, but no more than once per hour.
At deactivation, when you confirm Deactivate in the Options page. ClipHutch also sends the current activation generation and a random operation ID so a retry cannot delete a replacement activation. The server deletes the active license-key and installation-UUID pair. If the server cannot confirm deletion, ClipHutch keeps the local key and explains that the slot was not freed. An optional local-only recovery removes the key from Chrome but does not free the server slot or remove the installation UUID.

The license service stores your license key, installation UUID, email address provided by Stripe at checkout, activation and last-seen timestamps, license status, and payment event identifiers needed for issuance and refunds. A confirmed deactivation deletes the matching active activation row. A deactivation tombstone retains SHA-256 fingerprints of the key and installation UUID plus the random activation and operation IDs so retries are idempotent and delayed older clients cannot recreate the slot. An unreactivated tombstone remains until an explicit activation supersedes it; a superseded tombstone is removed by the daily cleanup after 90 days.

A redacted mutation journal stores SHA-256 fingerprints instead of raw license keys, installation UUIDs, or email addresses. Journal rows expire after 90 days and are removed by the next daily cleanup. Raw Stripe refund-event correlation, including payment-intent IDs and refund amounts, expires after 30 days while unmatched and after 365 days once matched to a ClipHutch or ComputedKit purchase; it is also removed by the daily cleanup. Cloudflare D1 Time Travel may retain database-wide recovery history for up to 30 days. Access is limited to license-service operators. The service does not receive your IP address other than what Cloudflare needs to route the request, browsing activity, page URLs, media URLs, filenames, or download history.

Earlier extension versions. In the currently published 0.1.3 build, Deactivate removes the local key but does not release the server device slot. Contact [email protected] for slot recovery. The server-confirmed flow applies only after a later version explicitly lists it in its release notes.

There are no analytics, telemetry, or update pings beyond Chrome's own extension-update mechanism. Capture Pack manifest content is written only to the local download you requested; ClipHutch does not send it to a ClipHutch-operated server.

When the popup or side-panel workspace shows a preview for a direct media file, or when you download media, the extension fetches the media directly from the source server that originally served it, using whatever credentials (cookies, referrer) your browser would normally send to that origin. For AES-128 encrypted HLS streams, the decryption key is fetched from the source server, used on your device for that download only, and never stored or sent to ClipHutch. The extension does not mirror, proxy, or relay these previews or downloads through any third party. ClipHutch does not send page or media URLs to ClipHutch, analytics services, or a download relay.

7. Permissions explained

ClipHutch requests seven Chrome API permissions. The HTTP/HTTPS host permissions are listed separately because Chrome classifies them separately.

Chrome permissions used by ClipHutch
Permission	Why it's required
`webRequest`	Observe network requests, including request headers, so the extension can detect media URLs as the page loads them and (when you click Download) replay the request headers the page sent. All processing happens on your device.
`alarms`	Schedule one-shot local cleanup wakes for selected-item header-lease expiry and sensitive download-artifact or Capture Pack manifest delivery/cleanup retries. Chrome may deliver an alarm late while the browser is asleep; ClipHutch also reconciles cleanup on the next service-worker/browser wake. The permission is not used for browsing, tracking, analytics, or periodic polling.
`storage`	Store detected media, selected Hutch media/page snapshots, review/run context, download-job state, and selected-item replay-header leases in browser session memory, and settings, license state, the installation UUID, notices, and rolling free-tier quota timestamps in browser local storage.
`sidePanel`	Host ClipHutch's packaged workspace beside the pages you browse so the Hutch and download activity can remain visible when you switch tabs. This permission does not grant additional access to page data.
`downloads`	Save detected media and the required redacted Capture Pack JSON manifest, plus an optional customer-selected CSV, via Chrome's built-in download manager.
`offscreen`	Briefly assemble HLS and DASH audio and video segments, combine separate audio and video tracks into one MP4, repackage MPEG-TS segments into MP4, or locally convert WebM direct files into downloadable MP4 files, or create a bounded local text Blob for a terminal Capture Pack manifest.
`declarativeNetRequestWithHostAccess`	For a selected download with a valid replay-header lease, install a temporary session rule that attaches the approved headers only to extension-initiated XMLHttpRequest/other requests and the selected source's exact scheme, origin, and path scope: the exact source URL for direct-media conversion, or the source origin and directory path for HLS/DASH parts. The rule never supplies previews and is removed on terminal cleanup, expiry reconciliation, or browser-session end.
`http:///`, `https:///`	Required for `webRequest` to observe network requests across HTTP/HTTPS sites and for the content script to scan image URL attributes on HTTP/HTTPS pages. The extension processes network request URLs, request headers it observed when the page loaded, image URL attributes already present in page markup, and the tab URL/title needed to associate detected media with the page.

ClipHutch Privacy Policy

1. What this extension does

2. What data it accesses

3. Where data is stored

4. What leaves your device

5. Chrome Web Store Limited Use

6. Open-source notices

7. Permissions explained

8. Contact