GetTheGists

GDPR overview

The privacy policy, last updated on 19 August 2026, devotes section 7 to Your Rights (GDPR / CCPA) and the site displays a GDPR-aligned badge. Concrete mechanisms are named: rights of access, rectification and erasure; self-service deletion of individual gists, a full library wipe and account closure from settings; immediate removal of local data when an account-less user uninstalls; and export requests by email. Consent handling is unusually explicit, with nothing optional loading before acceptance, one-click refusal weighted the same as acceptance, and Global Privacy Control signals treated as a standing refusal. Two gaps remain: no Article 27 EU representative is designated although the publisher is established outside the EU, and no data processing agreement is offered. SOC 2 is presented as a roadmap item, not as an achieved certification.

Who owns the data?

You keep your content. The publisher states that the text of the pages you summarise is never stored, logged or retained: it is processed in memory and discarded immediately. What does reach the servers is narrow and deliberate. A gist becomes persistent only when you tap Save, and even then only the gist, the why-it-matters block, the key points and the source link are kept, never the original page text. Account email, aggregated usage counters and hashed network identifiers complete the picture. The publisher declares that it does not sell your data and does not use it to train AI models. You can delete a saved gist individually, wipe the whole library or close the account, which removes every save.

Reuse rights

The summaries, answers and gists produced for you are yours to reuse without asking permission. The product is built around that assumption: export to Notion, Obsidian or Bear in one tap, copy clean Markdown that already carries the source link and key takeaways, and share the result with colleagues. The terms state that you may use the tool for personal and professional reading and export summaries to your note-taking apps. Two limits apply. Commercial redistribution of the output is prohibited, so you cannot resell the summaries as a product of their own. And because the output is AI-generated, the publisher asks you to verify it against primary sources before relying on it for anything critical.

Data retention & training

Hosting summary

The publisher does not disclose any hosting country or region, which is the most notable gap in an otherwise detailed privacy page. What is described is the handling rather than the geography. Page content is processed in memory only and never written to disk. Summaries and chat history inside the extension stay in the browser's local storage, as does the anonymous device identifier, and both are cleared on uninstall. Saved gists, the account email address and any voluntary feedback are held in what the policy calls an encrypted database on the publisher's own servers. Payment details never reach those servers at all: billing is handled by a PCI-compliant processor, with Stripe named in the team billing area. All traffic between the extension and the servers is encrypted with HTTPS/TLS. For jurisdiction, the only firm anchor is corporate rather than technical: the publisher is a Canadian federal corporation based in Montreal, Quebec, and the terms are governed by Canadian federal law and the law of Quebec. The public website itself resolves to a United States address on Squarespace infrastructure.