Your private work is not inventory.

The local browser extension

The current Fullary Local Chat Memory browser-extension preview runs on chatgpt.com and is separate from the Fullary cloud workspace and ChatGPT app. It processes visible message structure locally to place controls and return you to a source message. It does not store a message until you explicitly choose a bookmark or Fullary menu action. An ordinary save keeps the chosen message or selected text, source role and capture type, conversation title and canonical URL, message and turn locators with fallback fingerprints and excerpts, save time, and Fullary-local folder only in extension storage for that browser profile.

Ordinary saved records are not uploaded to Fullary or another server. The extension does not send analytics or diagnostics, sell data, use it for advertising, or use it to train AI or machine-learning models. It stores text and source metadata only; it does not copy image, audio, video, or file contents. ChatGPT and your browser remain separate services governed by their own terms and privacy practices.

Optional public-message links

The currently submitted version 0.4.0 Chrome Web Store candidate remains local-only and does not create public links. The separate version 0.5.2 public-link candidate lets a signed-in Free, Pro, or Owner creator choose Create link. Ordinary local saves still never upload automatically. The extension requests the temporary message draft only after the creator reviews the exact text, chooses a duration, confirms publication, and—if needed—signs in to Fullary.

The action can send one exact plain-text user message or ChatGPT response only after the excerpt, anyone-with-link warning, and a duration of one hour, one day, one week, one year, or permanent until revoked are confirmed. One week is the default and the longest Free duration; Pro and Owner can choose one year or permanent. The extension holds that draft for at most 10 minutes, bound to the same browser tab and window. It opens only https://fullary.com/share/from-extension; a high-entropy draft reference may appear only in the URL fragment, which browsers do not send in the HTTP request. After sign-in, the server validates the account tier and duration choice, computes any expiry itself, screens the draft, and publishes an unlisted immutable snapshot. It contains only the exact message, its role, and a server-derived title, excluding the account, conversation title and URL, folders, projects, locators, surrounding messages, source metadata, and local vault. Anyone with the resulting raw link may view it without a Fullary or ChatGPT sign-in until it expires or the creator revokes it.

Optional account-page navigation

After you enable the extension, its drawer may show Create free Fullary account / Sign in. Only your trusted click opens the fixed address https://fullary.com/extension/welcome in a new tab. The extension appends no query, fragment, identifier, or other payload and does not transfer saved text, source details, searches, folders, exports, ChatGPT content, or vault data. Ignoring the button changes nothing, and local saving continues without a Fullary account.

This new tab is an ordinary visit to Fullary.com. Like other website visits, Fullary and its hosting or security providers may process the IP address, browser or user-agent information, request time, and limited security and reliability logs under this notice. Those normal request details are not read from the local vault and do not let the website inspect it.

Browser permissions

The intended public extension requests browser storage, browser context menus, and access to chatgpt.com for local tools. It does not request broad Fullary.com access. The separate public-link candidate also declares an isolated bridge only for the exact https://fullary.com/share/from-extension route; it does not give the extension general access to Fullary.com. The extension does not request cookies, general browsing history, every-website access, identity, payments, downloads, or remote executable code.

Local retention, export, and removal

Extension records remain in that browser profile until you remove individual records, clear the extension's data, remove the extension, or lose the browser profile. You can export them as JSON from the Fullary drawer. The build does not automatically back up or synchronize ordinary records, so removal may be irreversible if you did not export first. Because Fullary receives no server copy, it cannot recover, remotely inspect, or remotely delete a local record.

Device Vault web app

The separate Fullary Device Vault page accepts text you paste or deliberately send through a supported installed web-app Share target. It does not add controls to native ChatGPT apps and does not read their history. A Share-target submission becomes one encrypted local draft; you must review it and press Save before it enters the permanent vault, or you can discard it. Before local storage, the title and body are encrypted with AES-256-GCM using a non-exportable key kept in that browser's IndexedDB. Search decrypts records in memory only while the page is open. The page sends no saved title or body to Fullary's account, database, analytics, marketplace, or device catalog.

Installing the web app is optional. Web Share Target and installation support depend on the browser and operating system. Ordinary records stay only in that installed app or browser profile and do not synchronize. A portable backup is created only when you request one: records are decrypted locally and re-encrypted with a passphrase-derived key before the file is downloaded. Fullary does not receive or retain the backup, passphrase, or recovery key and cannot restore them if they are lost. The service worker caches the Device Vault page for offline opening and intercepts supported Share-target submissions locally so the shared text is encrypted into a single pending IndexedDB draft rather than sent to the website.

Chrome Web Store Limited Use

The currently submitted version 0.4.0 build uses handled information only for its local save, organize, search, export, and return-to-source features; it has no public-link transfer. The separate public-link candidate's confirmed flow sends only one exact message, role, and strict duration choice, with no source URL, chat title, folders, searches, export, vault, or surrounding conversation. Handled information is not used for personalized advertising, credit decisions, data brokerage, unrelated analytics, or model training.

What the cloud service collects

Separately from the local extension, the Fullary cloud service stores account identifiers needed to operate your workspace, text and metadata you manually submit to that service, folders and projects you create, relationships you deliberately create among Problem, Attempt, Failure, and Outcome records, subscription state, and limited security and reliability logs. Sign-in is used only to authenticate the account. It does not give Fullary access to ChatGPT conversations, and the cloud service does not scrape, crawl, import, or reconstruct chat history. Unless a section expressly refers to the local extension, the remaining sections below describe the Fullary cloud service.

Marketplace preview and future transactions

The current Fullary Market is a preview and private-draft pilot, not a live marketplace. When a signed-in creator deliberately uses the draft studio, Fullary stores the account-linked stall name, draft title, proposed delivery type, intended USD price, exact-deliverable description, rights confirmation, and timestamps. Drafts are private and cannot be purchased. The pilot does not request seller identity documents, bank details, tax records, buyer data, orders, marketplace payments, commissions, or payouts. Do not place that information in a draft or ordinary support email.

Fullary intends to use Tap Payments for a future Marketplace flow, subject to Tap's contractual, technical, KYC/KYB, category, country, and compliance approval and Fullary's completion of the required legal and product controls. If that flow is activated, Fullary and Tap may process the minimum information needed for seller onboarding and verification, payment and fraud screening, order administration, split allocation, refunds, disputes, chargebacks, reconciliation, and seller payout status. That may include seller identity and business details, ownership and authorized-signatory information, tax or registration information, bank-account evidence, provider account and verification identifiers, buyer contact and billing information, order and delivery records, amounts and currencies, risk results, and support evidence. The activated onboarding screen will identify the secure collection route and applicable controller or processor before documents are requested. Fullary does not receive full payment-card details from a provider-hosted checkout.

How cloud private content is used

Private items are used to provide search, organization, and features you request. Private content is not placed in public discovery, sold to data brokers, or used for advertising.

Cloud sharing and source links

Fullary does not automatically publish private cloud items, create public profiles, or expose a workspace to other Fullary users. A confirmed extension message link or a deliberately created cloud-workspace link stores an immutable snapshot of only the exact text, a title derived from that text, its role label, expiry, revocation state, and irreversibly hashed high-entropy request and URL values. Folder, project, account, conversation, and source-link metadata are not included in the public snapshot. Anyone with the raw URL can view and forward that snapshot until it expires or you revoke it; they can also copy it or take screenshots. Share pages are marked for search engines not to index, but no technical measure can prevent copying or guarantee that every crawler obeys. The public title and a short excerpt may appear in social or messaging link previews. An optional source URL on a private record is stored only as a user-provided bookmark; Fullary does not use it to fetch or copy the linked content. We disclose data only to service providers that help operate Fullary, when you direct us to do so, or when disclosure is reasonably required by law, security, or the protection of rights.

Public-content screening and reports

Before a public snapshot is created, Fullary uses a conservative text screen to reject high-confidence patterns involving sexual exploitation, explicit sexual material, violent threats, hateful incitement, extremist recruitment, authentication secrets, and financial or payment identifiers. The screen does not make private records public and does not replace human review. It may reject legitimate text conservatively; Fullary does not promise it will identify every prohibited variation.

A public-page visitor may deliberately submit a category, bounded description, optional contact email, and confirmation for owner-only review. Copyright or IP reports require a contact email. Fullary stores only a hash of the high-entropy tracking token and returns the raw tracking URL once. Reviewers can see the reported public snapshot and report details, record a decision, and revoke a link. A takedown purges the public title and text; bounded report, decision, internal account-binding, and security metadata may remain for up to 365 days for abuse prevention, appeals, disputes, and legal obligations. Reporter contact details are not shown to the publishing account and are used only to clarify or resolve the report. Privacy requests can be sent through Support.

Operator and contact

Fullary is operated by Modern Science House SPC, Commercial Registration No. 1568033, a company registered in the Sultanate of Oman. Privacy requests may be sent to admin@fullary.com.

Service providers and payments

Fullary uses OpenAI account authentication for the website, Auth0 for OAuth account linking between ChatGPT and the Fullary plugin, and OpenAI Sites infrastructure backed by Cloudflare services. Auth0 may process the verified account identity, authorization subject, and permissions needed to link the plugin to the correct Fullary account; it does not receive a user's Fullary workspace content through this sign-in flow. Paid Fullary Pro subscriptions are sold through Lemon Squeezy as Merchant of Record. Lemon Squeezy processes subscription payment, billing, indirect-tax, invoice, refund, and fraud-prevention information under its own privacy notice.

Lemon Squeezy is not the payment rail for third-party Fullary Market sales. Fullary is evaluating Tap Payments for future marketplace seller onboarding, checkout, split allocation, refunds, disputes, chargebacks, reconciliation, and payouts. No such live transaction flow is enabled today, and naming an intended provider is not a claim of provider approval. If activated, Tap's own notices and the final checkout or onboarding disclosures will also apply. Fullary does not receive full payment-card details from provider-hosted payment pages.

Cloud retention and deletion

We keep account and cloud-workspace data only for as long as reasonably needed to provide Fullary, meet legal obligations, resolve disputes, and protect the service. When a share is revoked or purged after expiry, its public snapshot content is removed and its public URL no longer resolves; limited non-content metadata may remain temporarily for security and abuse controls. You may export or delete cloud-workspace data through account controls. Limited records may be retained where required for security, fraud prevention, billing, tax, or other legal obligations.

International cloud processing and security

Our cloud providers may process data outside your country. We use reasonable administrative and technical safeguards appropriate to the service, but no online service can guarantee absolute security. Do not save credentials, payment-card data, government identifiers, medical records, or other highly sensitive material in Fullary.

Your choices and rights

For cloud account, workspace, and confirmed public-snapshot data, you may use available account controls or request access, correction, export, revocation, or deletion through the Support page. Ordinary local extension records are controlled through local removal, browser-data, and export options; Fullary has no server copy of those ordinary saves to act on. Depending on applicable law, you may also have rights to restrict or object to processing or to complain to a data-protection authority. We may need to verify a request before acting on it.

Changes to this notice

We will update the date shown on this page when this notice changes. If a change materially affects how local extension records or private cloud-workspace content is handled, we will provide additional notice where reasonably possible or legally required.