Thingport Grab privacy policy

Effective 12 October 2026.

Thingport Grab is a browser extension that imports 3D-printing models from MakerWorld, Printables and Thingiverse into your own self-hosted Thingport instance, and converts MakerWorld files for other slicers in your browser. It has no servers of its own: the extension's developer never receives any of your data, and nothing is shared with anyone else.

What the extension stores

Everything below is kept in your browser's local extension storage, on your device only, except the list of recent imports, which is synced between your browsers as described below.

Your Thingport connection: the address of your Thingport instance, and the email and password you sign in to it with. They're stored as you entered them, so the extension can sign in again when its session expires.
A session token your Thingport instance issues when the extension signs in.
Your settings: whether the extension is switched on.
Recent imports: the title and a link for the last five models you imported through the extension, shown in its toolbar popup. This list is kept in your browser's sync storage, so it appears in the extension on your other browsers and devices where you're signed in to the same browser account and have sync on. It travels through your browser vendor's sync service (Google, Mozilla or Microsoft) under that service's own privacy terms. It doesn't include your email or password: entries are tied to your Thingport account by a one-way hash of your instance address and email. Each model's thumbnail is fetched from your Thingport instance and kept in local storage on each device; it isn't synced.
Your Printables and Thingiverse usernames, as last sent to your Thingport instance, so they're only sent again when they change, and when it last read your Printables collections and likes.
Collection import progress: while a MakerWorld collection import is running, the list of model pages still to visit, so it can carry on across page loads. It's deleted when the import ends.

What the extension sends, and where

The extension only communicates with your Thingport instance (the address you entered) and with the provider site you're on.

To your Thingport instance:

Your email and password, to sign in.
The address of each model page you open on MakerWorld, Printables or Thingiverse, to check whether you've already imported that model. This happens when the page opens, so the extension knows whether to show its button. On a MakerWorld collection page, the same check runs for each model in the collection when you open the extension's panel there.
The address of whatever you import, and your choice of collection, when you import it.
On a collection or Thingiverse Likes page, when you open the extension's panel: the page's address, to check whether that collection is synced. When you turn sync on: the collection's name and the ids of the models listed in it, so your instance knows which models are new later.
A request for the slicer picked in your Thingport Configuration, when a MakerWorld model page opens, so the extension knows whether to show its Download normalized button.
If you're logged into MakerWorld in this browser: your MakerWorld session cookie, when you import from MakerWorld. MakerWorld requires it to download files. The extension also saves it to your Thingport account's MakerWorld setting, so imports made from Thingport's own web app work too.
If you're logged into Printables or Thingiverse in this browser: your username there, when it first sees it or it changes, so Thingport's web app can list your collections on that site when you pick one to sync with.
If you're logged into Printables in this browser, at most once an hour while you're on its pages: your Printables collections (names, model counts and a few model pictures, private collections included), the models you liked there, and the models in the private collections you sync. Only you can see these on Printables, so this is how Thingport can sync them.

To MakerWorld, Printables and Thingiverse:

On MakerWorld, to find a model's download link, the extension asks MakerWorld's own website for it, the same way the page does when you click Download, using your existing MakerWorld session. It may also click the page's own Download button and read the link from the download that starts; that download is cancelled and removed from your download history straight away, so no file is saved.
When you click Download normalized on a MakerWorld model page, the extension downloads that model's file from MakerWorld, as the page's own Download button would, converts it inside your browser and saves the result to your downloads. The file isn't sent anywhere else.
On a MakerWorld collection import, the extension moves your tab from one model page to the next, just as if you were clicking through them.
On Printables, once per open tab, the extension asks Printables' own API which account you're logged in as, the same way the page does, using your existing Printables session. At most once an hour it also asks it, the same way, for your collections, your liked models and the models in the private collections you sync.

The extension reads, on supported pages only: the model's title, MakerWorld's page data for the model, the model links listed on collection pages, and, on Thingiverse, your username from the page's header. It doesn't read any other websites.

What the extension doesn't do

No analytics, tracking, telemetry or crash reporting.
No advertising.
No data sent to the extension's developer, or to any third party.
No selling or sharing of data.
No code downloaded from the internet: everything the extension runs is included in it.

Permissions

Permission	Why
Storage	Keeps the settings and data listed under "What the extension stores".
Cookies	Reads MakerWorld's and Printables' session cookies, only on their sites (see above).
Downloads	Reads the link from the MakerWorld download it starts, then cancels and removes that download.
Access to MakerWorld, Printables and Thingiverse	Shows the import button, and MakerWorld's Download normalized button, on their pages.
Access to your Thingport instance	Requested for that one address when you set the extension up, so it can talk to your instance.

Your control over your data

Change your Thingport connection, or switch the extension off, from its toolbar popup.
Uninstalling the extension deletes everything it stored on that device. The synced list of recent imports can stay in your browser account's sync data while the extension is still installed on another of your browsers; clearing your browser's synced data removes it.
Anything the extension sends to your Thingport instance is stored on your own server, under your control, like everything else in your Thingport library.

Changes

If this policy changes, the updated version is published here with a new effective date. Every past version is in the project's git history.

Contact

Questions about this policy or the extension: open an issue on GitHub.

7.7 KiB Raw Blame History