On this page
Content never touches Filed's servers
Every URL, article, highlight, quote, and note you save goes directly from your browser to the Notion API. Filed's backend only handles OAuth tokens and billing data.
📸 [Image: What to show: a simple diagram showing browser → Notion API direct connection, with Filed server to the side handling only "OAuth token" with no content arrow]
Audio never leaves your device
Audio memos use the browser's built-in Web Speech API. Speech recognition runs locally. Neither the audio recording nor interim transcription results are transmitted anywhere. Only the text transcript is saved, to Notion, directly from your browser.
Your Notion content stays in Notion
Filed cannot read your existing Notion pages or databases unless it needs to fetch a database schema to show you property options when you configure a workflow. It never reads the content of your existing pages.
OAuth tokens are stored locally
Your Notion access token is stored in chrome.storage.local, encrypted by Chrome's storage layer, never sent to Filed's servers.
The token grants Filed permission to create pages in your workspace on your behalf. It cannot be used to log into Notion, access other accounts, or read content outside of what Filed explicitly requests.
What Filed does collect
Filed's backend receives:
- Your Notion OAuth token, for workspace connection
- Billing data (plan, subscription status), if you're on Pro
- Your country, derived from your IP address at save time for aggregate analytics. Your IP is discarded immediately and never stored.
- No page content, no article text, no highlight data, no URLs of pages you save
Filed's server never sees what you capture.
Mobile app (Android)
The Android app follows the same privacy model. Your Notion token is stored on your device and never transmitted to Filed's servers except during the initial OAuth exchange. Content goes directly from your phone to the Notion API.
One difference: the mobile app sends a save count to Filed's backend (used for stats and badges). No content, no URLs. Only the number.
Chrome permissions explained
| Permission | Why | What it cannot do |
|---|---|---|
| activeTab | Read the current tab's URL, title, and selection when you trigger a capture | Cannot read tabs you haven't triggered a capture from |
| storage | Store settings, workflows, history locally on your device | Stored data never leaves your device |
| alarms | Schedule background retries for queued captures | Not used for tracking or data collection |
| contextMenus | Add "Save quote" to the right-click menu | No access to right-click content itself |
| scripting | Inject the toast and selection toolbar into pages | Scripts are only injected when you actively use Filed |
| https://api.notion.com/* | Send captures to Notion | Access is limited to the Notion API only |