Distill is a Chrome extension that turns your Reading List into one time-sized synthesis. To do that, it extracts the text of your saved articles on your device and sends that text to a hosted backend, which runs the synthesis. This policy explains exactly what data Distill handles, where it goes, how long it's kept, and what you can do about it.
Distill stores your profile, settings, cached results, and saved digests on your own device. When you ask for a synthesis, the extension extracts your saved articles' text locally and sends that text to the Distill backend, which generates the result and streams it back. There is no account, no sign-in, no API key, and no payment — use is free with daily caps. We do not sell, rent, or share your data with advertisers, data brokers, or analytics vendors.
01Who we are
"Distill," "we," and "us" refer to the developers of the Distill Chrome extension and the
marketing site at distill.productivities.fyi.
For privacy questions, contact support@productivities.fyi.
02What Distill collects, and where it goes
The table below is the complete list of data the extension handles. Each row names the data, where it is stored, why we have it, and (for anything that leaves your device) which parties see it.
| Data | Stored where | Purpose | Shared with |
|---|---|---|---|
| Reading List entries (URLs + titles) | Read on demand from Chrome's chrome.readingList; held in memory while a synthesis runs |
Know which articles to extract and synthesize | Nobody. The list itself never leaves your device |
| Extracted article textin-use | Extracted on your device; sent to the Distill backend for the duration of the request | Sent to the backend so it can generate the synthesis you asked for | The Distill backend (Supabase, U.S.) and its model provider, DeepSeek. The backend never fetches your URLs — it only receives already-extracted text |
| Profile (role, stage, interests) | chrome.storage.local on your device |
Personalize the synthesis; included in the prompt sent to the backend | Sent to the backend as part of the generation request; not stored there beyond the request |
| Settings and consent flag | chrome.storage.local on your device |
Remember your preferences and that you consented to hosted processing | Nobody |
| Cached results and saved digests | chrome.storage.local on your device |
Avoid regenerating the same synthesis and let you revisit saved results | Nobody |
| Generation request metadata | The Distill backend (transient request logs, retained briefly for abuse prevention and debugging) | Apply daily caps, debug failures, and detect abuse of the free service | Nobody outside our backend hosting providers (Supabase, Cloudflare) |
| Anonymous session tokenoptional | The Distill backend (Supabase) and your local extension storage | Raise your daily cap without a sign-in by giving the request an anonymous identity for rate-limiting | Supabase. The token is not tied to your name, email, or any personal identifier |
03Browser permissions
Chrome shows you the permissions Distill requests at install time. Here's what each one is actually used for:
readingList— read the URLs and titles in your Chrome Reading List so Distill knows what to synthesize, and remove entries when you mark them read.storage— the local profile, settings, cache, and saved digests described above. Nothing inchrome.storage.localis synced to your Google account.host_permissionsfor<all_urls>— needed so the extension can fetch and extract the text of your saved articles headlessly (including PDFs, Google Docs, and other documents). This permission also covers reaching the Distill backend. Distill does not read the page in your active tab — there is no content script.
04Hosted processing and the model provider
Distill is hosted-only: every synthesis is generated by the Distill backend, not by an API key you supply. There is no bring-your-own-key mode. The backend runs on Supabase (Edge Functions on Deno, Postgres) and calls DeepSeek as the model provider. The backend receives the extracted article text and your profile for the request, generates the result, streams it back, and does not retain the article text or output beyond what's needed to serve the request.
Before the first hosted request, Distill shows a one-time consent screen naming that your extracted article text will be sent to the backend for processing. You can withdraw by clearing the extension's data or uninstalling it.
05No accounts, no payments
Distill has no user accounts, no sign-in, and no Google OAuth. It does not process payments and uses no Stripe. The service is free, with daily caps for cost control. If you choose to support the project, you can do so through Ko-fi, which handles that transaction entirely on its own platform under its own privacy policy — Distill never sees your payment details and a Ko-fi contribution is not linked to your usage.
06What we do not collect
- We do not run analytics, ad-tracking, fingerprinting, or session-replay code inside the extension or on the marketing site.
- We do not collect your browsing history. Distill only reads the Reading List you maintain, not the pages you visit.
- We do not sell, rent, lease, or trade personal data to anyone, and we do not share it with advertisers or data brokers.
- We do not use your extracted article text, profile, or generated syntheses to train our own models. (DeepSeek processes the request under its own policy — read theirs.)
- We do not publish your syntheses. Distill has no community or sharing feature; every result is private to your device.
07Children
Distill is not directed to children under 13, and we do not knowingly collect data from them.
08Security
Local data lives in chrome.storage.local and is protected by Chrome's own profile
isolation. Traffic to the backend runs over TLS. Backend infrastructure is hosted on Supabase
(encrypted at rest). No system is perfectly secure; if you discover a vulnerability, please email
support@productivities.fyi before disclosing it.
09Your rights and choices
- Delete your local data by clearing the extension's storage or uninstalling the extension. Because there is no account, this removes essentially everything Distill holds about you.
- Stop hosted processing by not running a synthesis; the backend only ever sees a request when you initiate one.
- Residents of the EEA, UK, California, and other regions with comprehensive privacy statutes have additional rights under those laws. Email support@productivities.fyi and we'll honor them.
10International transfers
Our backend infrastructure (Supabase, Cloudflare) and the model provider (DeepSeek) process data outside some users' home countries, including in the United States. If you use Distill from outside those regions, the data described above is transferred to and processed there under standard contractual clauses with each sub-processor.
11Retention
- Local profile, settings, cache, and saved digests: kept on your device until you clear them or uninstall.
- Extracted article text and generated output at the backend: held only for the duration of the request, not stored afterward.
- Request metadata / logs: retained briefly for abuse prevention and debugging, then purged or aggregated.
12Changes to this policy
We will update this policy when the data flows change. Material changes are announced in-extension and on the marketing site before they take effect. The "Effective" date at the top of this page always reflects the current version; prior versions are kept in the public Git history of the marketing-site repository.
13Contact
Questions, complaints, requests: support@productivities.fyi. We do our best to respond within five business days.