Privacy Policy

Last updated: July 30, 2026

Your data never leaves your browser.

Noya is local-first. There is no Noya account to create, no Noya cloud for your library, and no backend that stores your bookmarks, notes, or highlights — because your library lives on your device.

Noya reads your own X bookmarks from your existing browser session and turns them into a reading queue, inbox, and library. Everything in that library stays on this device unless you export it.

Short version

Stored on your device

Saves (bookmark content and metadata), tags, Inbox / Queue membership, reading progress, highlights, notes, settings, and the auth/runtime metadata Noya needs to stay connected to your X session.

Sent to X only (for Sync)

Authenticated requests to x.com / twitter.com to fetch your bookmarks (and, when you choose, optional unbookmark actions). Your library is not uploaded to a Noya server.

Wallpaper images only when shown

New Tab ambient backgrounds may load photos from images.unsplash.com. That is a direct image request from your browser — not a Noya analytics pipeline.

Export is yours

You can export a portable backup of your library (saves, tags, state, highlights, notes) as a JSON file on your machine, and import it to restore.

Permissions explained

Each permission maps to a specific feature. These are the permissions Noya declares in its Chrome extension manifest for the current build.

storage

Always on
Why
Noya needs local storage so your reading queue, library, and notes work like an on-device app.
What it does
Stores saves, tags, Inbox / Queue membership, reading state, highlights, notes, settings, and runtime/auth metadata in browser storage on this profile.

webRequest

Always on
Why
Noya needs to read the auth headers already present in your own x.com session so it can sync bookmarks without asking for a password.
What it does
Observes your x.com / twitter.com GraphQL requests so Noya can capture authorization, CSRF, and related headers required to load your own bookmarks locally.

cookies

Always on
Why
Noya needs to detect whether you are signed into X and keep CSRF tokens current without asking for your password.
What it does
Reads x.com session cookies (such as auth and CSRF-related cookies) locally so Sync can run against the account already logged into this browser profile.

declarativeNetRequest

Always on
Why
Noya’s extension-initiated X requests need to match the authenticated browser session you already have.
What it does
Applies required Origin / Referer headers when Noya asks x.com for bookmarks (and related GraphQL operations) from the extension service worker.

https://x.com/* · https://twitter.com/*

Always on
Why
Noya only works against your own account on X, so it needs permission to talk to those hosts for Sync and session-related operations.
What it does
Lets Noya make authenticated API requests to fetch your bookmarks, observe session-related request metadata, and (when you choose) perform optional unbookmark actions against X Bookmarks.

https://images.unsplash.com/*

Always on
Why
New Tab ambient home can show curated wallpaper photos hosted on Unsplash’s CDN.
What it does
Allows the extension page to load image assets from images.unsplash.com. Noya does not send your library content to Unsplash.

chrome_url_overrides → newtab

Always on
Why
Noya’s App Shell can replace the browser New Tab with your Reading Queue so finishing what you saved stays in view.
What it does
Opens Noya when you open a new tab. You can turn New Tab replacement off in settings and still open Noya from the extension action.

Full policy

What Noya stores

  • chrome.storage.local stores your library (saves with content and metadata as available), tags, Inbox / Queue membership, reading state, highlights, notes, and extension settings (for example New Tab preference and onboarding state).
  • The same local store holds runtime and auth metadata needed for Sync — such as captured authorization / CSRF-related headers and GraphQL query identifiers for X Bookmarks — so Noya can keep working with your existing session.
  • Sync metadata (for example last sync timestamps) may also be kept locally to power the Sync UI.
  • When the UI is opened outside the extension context (for example a local demo), small preferences may fall back to localStorage in that browser context only.
  • Noya does not run a backend database for extension library data.

What Noya sends over the network

  • Noya sends authenticated API requests to x.com / twitter.com to fetch your bookmarks (and tweet/thread details as supported). Those requests use credentials already present in your browser session.
  • If you use an optional Unbookmark action (remove from X Bookmarks), Noya may send authenticated requests to X to delete that bookmark. Marking a save Done in Noya is local by default and does not unbookmark on X unless you choose that path.
  • New Tab wallpapers may request images from images.unsplash.com.
  • The extension does not send analytics or behavioral telemetry to a Noya-operated server.
  • Noya does not sell personal library data or share it with advertising or tracking platforms.

X / Twitter session

  • You must already be signed into X in the same Chrome profile. Noya never asks for your X password.
  • Auth headers and cookies are used only so Noya can access your bookmarks and related content, and only while the extension is installed on that profile.
  • Session credentials stay in local browser storage on this profile. They are refreshed from live x.com traffic and cookie state as needed.

How long data stays

  • Your library (saves, tags, reading state, highlights, notes) remains on the device until you clear it, reset the library, remove the extension, or wipe the browser profile.
  • Captured auth headers and related runtime metadata remain in local storage until session/auth state changes, you clear extension data, or you remove the extension.
  • Export packages are ordinary files you save yourself; Noya does not upload them.

Your controls

  • You can remove the extension at any time.
  • You can clear or reset local library data from Noya settings (or by removing the extension).
  • You can export your library for backup and import it later — including on another machine or profile where Noya is installed.
  • You can disable New Tab replacement in settings and open Noya from the extension icon instead.
  • Chrome manages extension permissions. To review or revoke host permissions, use Chrome’s extension details page for Noya.
  • If you use Noya in another browser profile, that profile has its own X login and its own local library.

This marketing website

  • The public site at noya.yilinglabs.com is separate from the extension’s local library.
  • At launch we aim for privacy-light analytics or none. If site analytics are enabled, they will be disclosed on this page and will not include your extension library contents.
  • Hosting providers may process standard server logs (for example IP address and user-agent) as part of delivering the website.

Children

Noya is not directed at children under 13, and we do not knowingly collect personal information from children through a Noya account system — there is no Noya account in v1.

Changes to this policy

If permissions or data practices change in a material way, we will update this page and the “Last updated” date. Significant changes will also be reflected in the Chrome Web Store listing where required.