Thingport/extension/PRIVACY.md

# Thingport Grab privacy policy

_Effective 12 October 2026._

Thingport Grab is a browser extension that imports 3D-printing models from MakerWorld, Printables
and Thingiverse into **your own self-hosted Thingport instance**, and converts MakerWorld files for
other slicers in your browser. It has no servers of its own: the
extension's developer never receives any of your data, and nothing is shared with anyone else.

## What the extension stores

Everything below is kept in your browser's local extension storage, on your device only, except
the list of recent imports, which is synced between your browsers as described below.

- **Your Thingport connection:** the address of your Thingport instance, and the email and password
  you sign in to it with. They're stored as you entered them, so the extension can sign in again
  when its session expires.
- **A session token** your Thingport instance issues when the extension signs in.
- **Your settings:** whether the extension is switched on.
- **Recent imports:** the title and a link for the last five models you imported through the
  extension, shown in its toolbar popup. This list is kept in your browser's sync storage, so it
  appears in the extension on your other browsers and devices where you're signed in to the same
  browser account and have sync on. It travels through your browser vendor's sync service (Google,
  Mozilla or Microsoft) under that service's own privacy terms. It doesn't include your email or
  password: entries are tied to your Thingport account by a one-way hash of your instance address
  and email. Each model's thumbnail is fetched from your Thingport instance and kept in local
  storage on each device; it isn't synced.
- **Your Printables and Thingiverse usernames,** as last sent to your Thingport instance, so they're
  only sent again when they change, and when it last read your Printables collections and likes.
- **Collection import progress:** while a MakerWorld collection import is running, the list of
  model pages still to visit, so it can carry on across page loads. It's deleted when the import
  ends.

## What the extension sends, and where

The extension only communicates with **your Thingport instance** (the address you entered) and with
the **provider site you're on**.

**To your Thingport instance:**

- Your email and password, to sign in.
- The address of each model page you open on MakerWorld, Printables or Thingiverse, to check
  whether you've already imported that model. This happens when the page opens, so the extension
  knows whether to show its button. On a MakerWorld collection page, the same check runs for each
  model in the collection when you open the extension's panel there.
- The address of whatever you import, and your choice of collection, when you import it.
- On a collection or Thingiverse Likes page, when you open the extension's panel: the page's address, to check whether
  that collection is synced. When you turn sync on: the collection's name and the ids of the models
  listed in it, so your instance knows which models are new later.
- A request for the slicer picked in your Thingport Configuration, when a MakerWorld model page opens, so
  the extension knows whether to show its **Download normalized** button.
- If you're logged into MakerWorld in this browser: your MakerWorld session cookie, when you import
  from MakerWorld. MakerWorld requires it to download files. The extension also saves it to your
  Thingport account's MakerWorld setting, so imports made from Thingport's own web app work too.
- If you're logged into Printables or Thingiverse in this browser: your username there, when it
  first sees it or it changes, so Thingport's web app can list your collections on that site when
  you pick one to sync with.
- If you're logged into Printables in this browser, at most once an hour while you're on its pages:
  your Printables collections (names, model counts and a few model pictures, private collections
  included), the models you liked there, and the models in the private collections you sync. Only
  you can see these on Printables, so this is how Thingport can sync them.

**To MakerWorld, Printables and Thingiverse:**

- On MakerWorld, to find a model's download link, the extension asks MakerWorld's own website for
  it, the same way the page does when you click Download, using your existing MakerWorld session.
  It may also click the page's own Download button and read the link from the download that
  starts; that download is cancelled and removed from your download history straight away, so no
  file is saved.
- When you click **Download normalized** on a MakerWorld model page, the extension downloads that
  model's file from MakerWorld, as the page's own Download button would, converts it inside your
  browser and saves the result to your downloads. The file isn't sent anywhere else.
- On a MakerWorld collection import, the extension moves your tab from one model page to the next,
  just as if you were clicking through them.
- On Printables, once per open tab, the extension asks Printables' own API which account you're
  logged in as, the same way the page does, using your existing Printables session. At most once an
  hour it also asks it, the same way, for your collections, your liked models and the models in
  the private collections you sync.

**The extension reads, on supported pages only:** the model's title, MakerWorld's page data for the
model, the model links listed on collection pages, and, on Thingiverse, your username from the
page's header. It doesn't read any other websites.

## What the extension doesn't do

- No analytics, tracking, telemetry or crash reporting.
- No advertising.
- No data sent to the extension's developer, or to any third party.
- No selling or sharing of data.
- No code downloaded from the internet: everything the extension runs is included in it.

## Permissions

| Permission                                       | Why                                                                                            |
| ------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
| Storage                                          | Keeps the settings and data listed under "What the extension stores".                          |
| Cookies                                          | Reads MakerWorld's and Printables' session cookies, only on their sites (see above).           |
| Downloads                                        | Reads the link from the MakerWorld download it starts, then cancels and removes that download. |
| Access to MakerWorld, Printables and Thingiverse | Shows the import button, and MakerWorld's Download normalized button, on their pages.          |
| Access to your Thingport instance                | Requested for that one address when you set the extension up, so it can talk to your instance. |

## Your control over your data

- Change your Thingport connection, or switch the extension off, from its toolbar popup.
- Uninstalling the extension deletes everything it stored on that device. The synced list of recent
  imports can stay in your browser account's sync data while the extension is still installed on
  another of your browsers; clearing your browser's synced data removes it.
- Anything the extension sends to your Thingport instance is stored on your own server, under your
  control, like everything else in your Thingport library.

## Changes

If this policy changes, the updated version is published here with a new effective date. Every
past version is in the project's
[git history](https://github.com/TautvydasDerzinskas/Thingport/commits/main/extension/PRIVACY.md).

## Contact

Questions about this policy or the extension:
[open an issue on GitHub](https://github.com/TautvydasDerzinskas/Thingport/issues).