tugpic Privacy Policy
Effective date: 2026-09-08 Last updated: 2026-09-08
1. Introduction
Byeongsu KIM, an individual developer ("I", "me", "we", or "us"), publishes tugpic (the "Extension"). tugpic is a Chrome extension that saves the image or video under your cursor when you hold a shortcut key and left-click, and can save every image in an article as one batch.
The short version: tugpic has no server, no account system, no analytics, and no advertising. It never sends anything to me. The only network requests it makes are the ones needed to download the media you clicked, and those go to the website you are already viewing. The rest of this Policy explains, in detail, what stays on your device and what leaves it.
2. Who We Are
- Operator: Byeongsu KIM (individual developer)
- Country: Republic of Korea
- Privacy contact: bysu.day@gmail.com
- Data Protection Officer / EU or UK representative: none. The Extension processes no personal data on my behalf, and I am an individual, not an organisation. I handle privacy questions myself at the address above.
3. Scope
This Policy applies to the tugpic Extension as distributed through the Chrome Web Store: its popup, its settings page, its background service worker, and the content script that runs on the web pages you visit.
To react to your click before the page does, the content script runs on every web page and in every frame. Chrome therefore shows the warning "Read and change all your data on all websites" when you install tugpic. The script uses that access only to find the media you clicked, show a small status message, and draw the image album. It does not read, modify, or transmit page content otherwise.
This Policy does not cover the websites you download media from. Those sites receive the download requests described in Section 4.3 and handle them under their own privacy policies.
4. Information We Collect
I do not receive any information about you. The categories below describe what the Extension stores on your device and what it handles temporarily while working. Each category traces to a specific line of the source code, which is public at https://github.com/bysuio/tugpic.
4.1 Information stored on your device
- Your shortcut preference — which modifier keys (Alt, Ctrl, Shift, Cmd/Win) and, optionally, which ordinary key you chose. Stored in Chrome's extension storage in the "sync" area. If you have turned on Chrome sync in your browser, Chrome copies this preference to your Google account so it follows you to your other devices; that copy is made by Chrome under Google's privacy policy, not by me, and I cannot see it.
- Your recent downloads — for the last ten downloads made through tugpic: Chrome's download id, the full path of the saved file (or, for a batch, the folder name, which is derived from the page title), whether it was an image or a video, and the time. Stored in the "local" area of extension storage on this device only, so the popup can list them and open the file location. Older entries are dropped automatically after ten.
- Download bookkeeping — while a download is in progress: its download id, the kind of media, for
blob:videos the temporary blob URL, the id of the tab that asked, the intended filename, and the ids that make up a batch so that "Undo" can cancel it. Stored in the "session" area, which lives in memory and is cleared when you close the browser; unmatched entries are discarded after five minutes.
4.2 Information processed temporarily on the page
The content script handles the following only in memory, only on the page where you use tugpic, and never stores or transmits it:
- The address of the media you clicked and the page title, used to name the file and, for batches, the folder
Downloads/tugpic/<page title>/. - The pixels of a
<canvas>element when you click one, converted to a PNG so it can be saved. - The list of images on the page (their addresses and sizes) while the popup or the album is open, so you can choose which to save.
- Addresses of video stream manifests (HLS/DASH) the page has already loaded, read from the browser's Resource Timing API so a streamed video can be reassembled. At most twenty are kept, per page, in memory.
- Which ordinary key is currently held down, only if your shortcut includes an ordinary key such as
D. tugpic keeps the key code in memory until you release it, leave the window, or switch tabs. With the default Alt-only shortcut these listeners are not attached at all. - The address of the current tab, read by the popup to tell you whether tugpic can run on that page.
The Chrome Web Store counts data as "collected" even when it is only read or stored on your device. That is why tugpic's store listing declares Website content, Web history, and User activity under data usage: they describe the on-device handling in this section and Section 4.1, none of which leaves your browser. My use of this information adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
4.3 Information that leaves your browser
To save a file, the Extension asks Chrome to download the media address you clicked, or fetches stream manifests and segments itself from inside the page. These requests go to the website you are viewing or its content delivery network, exactly as the page's own requests do. They carry your IP address and, for requests made from the page, the cookies that site has already set, because some sites refuse downloads without them. The popup also loads image thumbnails from those same addresses. None of these requests are sent to me, and I do not receive their results.
4.4 Information we do not collect
I do not collect your name, email address, account credentials, payment details, location, browsing history, page contents, usage statistics, crash reports, device identifiers, or cookies. The Extension contains no code that transmits data to me or to any analytics, advertising, or monitoring service, and it bundles no third-party libraries. The source code is public, so anyone can verify this.
If you contact me by email or open an issue on GitHub, that message is handled by your email provider or by GitHub under their own policies; I keep it only to answer you.
4.5 Sensitive information
I do not collect sensitive information of any kind.
5. How We Use Information
The information in Section 4 is used only to:
- Apply the click shortcut you chose
- Save the media you clicked, and name the file or batch folder
- Show you a short status message and your recent downloads, and let you undo a batch
- Reassemble a streamed video from the segments the page has loaded
I do not use any information for marketing, advertising, profiling, automated decision-making, or AI features, and I cannot, because nothing reaches me.
6. Cookies and Tracking Technologies
The Extension sets no cookies and uses no analytics, advertising, tracking, or session-replay technology. It uses Chrome's extension storage as follows:
| Category | Item | Purpose |
|---|---|---|
| Strictly necessary | Download bookkeeping (session storage, in memory) | Match a finished download to the tab that started it |
| Functional | Shortcut preference (sync storage) | Remember your shortcut |
| Functional | Recent downloads (local storage) | List your last ten downloads in the popup |
There is no consent banner, because there is nothing optional to consent to. You can remove all of the above at any time by uninstalling the Extension (Section 14).
Global Privacy Control and "Do Not Track" signals do not change the Extension's behaviour, because it performs no tracking to opt out of.
7. Legal Bases for Processing (EEA, UK, and similar regimes)
Because no personal data reaches me, I do not act as a controller of your personal data in the ordinary sense. To the extent the on-device handling described above is treated as processing attributable to me, its sole purpose is to perform the function you invoke, and the basis is the provision of that function at your request (performance of a contract, GDPR Article 6(1)(b)) and my legitimate interest in making the Extension work as described (Article 6(1)(f)).
8. How We Share Information
I hold no personal information, so I do not share, sell, rent, or disclose any, and I have never done so.
Two parties receive data because of how you use the Extension, without my involvement:
- The websites you download from receive the download requests described in Section 4.3.
- Google LLC, through Chrome sync, receives your shortcut preference if you have enabled Chrome sync. This is a browser feature you control in Chrome's settings and is governed by Google's privacy policy.
9. Service Providers
I engage no service providers to process data on my behalf. The Extension is distributed through the Chrome Web Store, operated by Google LLC, which handles installation and updates under its own terms.
| Provider | Purpose | Information involved | Location |
|---|---|---|---|
| Google LLC (Chrome Sync) — only if you enable it | Copy your settings across your devices | Shortcut preference | Google's infrastructure, under Google's privacy policy |
10. International Data Transfers
I do not transfer any personal data internationally. If you enable Chrome sync, Chrome may store your shortcut preference in your Google account on servers outside your country; that transfer is made by your browser under your Google account settings, not by me. Download requests travel to wherever the website you are viewing is hosted.
11. Data Retention
| Information | Retention |
|---|---|
| Shortcut preference | Until you change it or uninstall the Extension. Chrome clears the Extension's storage on your device when it is removed; the synced copy, if any, is managed by Chrome under your Google account and can be cleared through Chrome's sync settings |
| Recent downloads | Only the ten most recent entries are kept; each is removed when it rolls off the list, when you undo its batch, or when you uninstall the Extension |
| Download bookkeeping | Until the download completes or fails, at most five minutes for unmatched entries, and in any case until you close the browser |
| Files you download | Saved to your Downloads folder and remain yours; the Extension does not manage them after saving except when you press Undo immediately after a batch |
Nothing is retained by me because nothing is sent to me.
12. Data Security
The Extension bundles all of its code, loads no remote scripts, and includes no third-party runtime libraries. Its on-page interface is rendered inside closed shadow roots so page scripts cannot read it. All data described in this Policy stays inside your browser's extension storage on your device, protected by your operating system account and by Chrome's extension sandbox. No method of storage is completely secure, and I cannot guarantee absolute security.
13. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information an organisation holds about you, to object to or restrict its processing, to withdraw consent, and to complain to a supervisory authority.
Because I hold no information about you, there is nothing for me to provide, correct, or delete, and I would be unable to verify that a request relates to you. You exercise full control directly:
- Change or clear your shortcut in the popup or the settings page
- Press Undo on the notice that appears after a batch download to cancel it and delete its files
- Uninstall the Extension to remove all stored data (Section 14)
If you have a question or believe this Policy is inaccurate, contact me at bysu.day@gmail.com. I respond within the period required by applicable law.
14. Account and Data Deletion
There are no accounts. To delete everything the Extension stores, remove it from chrome://extensions; Chrome clears the Extension's storage when it is uninstalled. Files you downloaded stay in your Downloads folder until you delete them yourself.
15. Additional Information for Users in the EEA and EU
If you are in the European Economic Area, the General Data Protection Regulation (GDPR) applies to personal data processed by a controller. As described above, I do not receive or hold your personal data. To the extent any processing is attributed to me, you have the rights in Section 13, including the right to object to processing based on legitimate interests and the right to restriction of processing, and the right to lodge a complaint with your local supervisory authority (a list is maintained by the European Data Protection Board). I have not appointed an EU representative, because the Extension involves no processing of personal data on my side.
16. Additional Information for Users in the United Kingdom
If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply in the same way. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. I have not appointed a UK representative, for the same reason.
17. Additional Information for Users in the United States and California
I am an individual developer distributing a free extension that collects no personal information, and I do not believe I meet the California Consumer Privacy Act's applicability thresholds. This section is provided for transparency.
17.1 Categories of personal information (preceding 12 months)
| Category (Cal. Civ. Code § 1798.140) | Collected | Sold or shared |
|---|---|---|
| Identifiers | No | No |
| Personal information under § 1798.80(e) | No | No |
| Commercial information | No | No |
| Internet or other electronic network activity | No (the recent-downloads list stays on your device and is never received by me) | No |
| Geolocation data | No | No |
| Audio, electronic, visual, or similar information | No (media you download is saved to your own disk) | No |
| Inferences | No | No |
| Sensitive personal information | No | No |
17.2 Your rights
California residents have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against. Residents of other states with comprehensive privacy laws have similar rights, including the right to opt out of targeted advertising and profiling and the right to appeal a denied request. Because I collect no personal information, there is nothing to sell, share, or use for targeted advertising, and no "Do Not Sell or Share" link is needed. I offer no financial incentives in exchange for personal information. Global Privacy Control signals have nothing to act on.
To submit a request or an appeal, email bysu.day@gmail.com. I respond within 45 days, extendable once by a further 45 days where permitted.
18. Additional Information for Users in South Korea
If you are in the Republic of Korea, the Personal Information Protection Act (개인정보 보호법) applies. A Korean-language version of this policy, in the structure Korean law expects, is available through the language switch on the page where this Policy is published. It states that the Extension collects no personal information, that there is no provision to third parties (제3자 제공), no outsourcing of processing (처리위탁), and no overseas transfer (국외 이전) on my side, and names me as the privacy officer (개인정보 보호책임자) with the contact above. Remedies: 개인정보분쟁조정위원회 (1833-6972), 개인정보침해신고센터 (118), and the police cybercrime unit (182).
19. Children's Privacy
The Extension has no age restriction and no sign-up, and it collects personal information from no one, so it holds no information about children. If you believe a child has sent me personal information by other means, contact me at bysu.day@gmail.com and I will delete it.
20. Changes to This Privacy Policy
I may update this Policy when the Extension changes. I will post the updated version, with a new effective date, at the address where this Policy is published, and note material changes in the Extension's release notes. Continued use after the effective date means the updated Policy applies. Previous versions are available on request.
21. Contact Us
- Email: bysu.day@gmail.com
- Source code and issues: https://github.com/bysuio/tugpic