Privacy Policy

Effective date: March 16, 2026 · Last updated: October 14, 2026

Overview

Web to File is a Chrome extension that exports webpage content as PDF, Markdown, EPUB, or image files. All processing happens locally in the user’s browser. The user can also choose to save an export to their own Google Drive, where the file goes straight from the browser to Google, or send it to their own Kindle, where the file passes through Web to File’s mail relay and is deleted once it has been mailed. Web to File does not keep user content and does not sell or share user data.

Your other files are never read

  • On your computer: the extension does not browse, list, or read the files on your device. It only writes the exports you ask for. The one exception is a local page you open in a browser tab yourself and choose to export, which Chrome allows only if you have turned on “Allow access to file URLs” for the extension.
  • In your Google Drive: the extension requests only Google’s drive.file permission. With it, Google lets the extension see only the files the extension itself created. Your other documents, photos, and folders in Drive are invisible to it: it cannot open, list, search, change, or delete them. Google enforces this limit on its side, and the Google sign-in screen shows it before you agree.

What the extension accesses

  • Page content on websites the user visits, only to extract or capture content for export.
  • The current tab and window state, so the side panel and export flow can target the active page.
  • Local extension storage, to save user preferences, export history, and temporary export data.
  • Chrome’s rendering pipeline, only during a PDF or screenshot export the user has started.
  • Google Drive, only if the user connects it, and only through the drive.file permission described above.
  • Web to File’s Kindle relay, only if the user sets up Send to Kindle, and only to deliver the files the user chooses to send.

Web to File begins working on a page only when the user starts an export, capture, preview, or selection, and only on the tab the side panel is open on. It does nothing on the other pages the user visits.

Network requests

Four features make requests. Two of them request data only from the site the user is already on:

  • EPUB export collects the article’s own images so they can be embedded in the file and stay readable offline. Those requests carry no cookies.
  • AI conversation export reads the conversation from the page the user has open, so the whole thread can be written to the file. Nothing is requested from anywhere else.

The other two send a file, and only when the user asks:

  • Save to Google Drive uploads the export the user chose straight from the browser to the user’s own Google Drive. It does not pass through any server of ours.
  • Send to Kindle uploads the export the user chose to Web to File’s relay, which emails it to the user’s Kindle address. This is the one feature that passes through a server of ours. See Send to Kindle below.

Apart from Send to Kindle, the extension sends nothing to any server of ours.

Google Drive

Saving to Google Drive is optional. Nothing is asked of Google until the user connects it, either in the extension’s settings or the first time they choose to send a file to Google Drive.

  • Permission: only https://www.googleapis.com/auth/drive.file. The extension can create files and see the files it created, and nothing else in the user’s Drive.
  • What is sent to Google: the exported file the user chose to send, and a folder named “Web to File” to keep those files together. Uploads happen only when the user clicks to send.
  • What is read from Google: whether that folder still exists, the link to each uploaded file, and the account’s email address. The email address is used only to show which account is connected, in shortened form, and to ask Google for the same account when sign-in is renewed.
  • Where it is kept: the email address, the folder’s ID, and links to sent files are stored locally in extension storage, so the export history can open them. While a send is unfinished, its upload session address is kept too, so “Send again” can continue it. Sign-in tokens are either managed by Chrome itself or held only in memory for the current browser session; they are never written to disk by the extension.
  • Disconnecting: the settings page has a Disconnect button. It revokes the extension’s access with Google and deletes the stored account details. Users can also remove access at any time from their Google Account, under Security, Third-party apps & services. Files already saved stay in the user’s Drive until the user deletes them.

Send to Kindle

Sending to Kindle is optional. Nothing is sent to our relay until the user opens Send to Kindle in the extension’s settings, which asks the relay whether the service is available, or sends a file to Kindle. Amazon accepts documents for a Kindle only by email from an approved sender, so this feature, unlike the rest of the extension, needs a server: api.webtofile.pandaopus.com, which mails the file from kindle@webtofile.pandaopus.com. The settings page says so before the first send.

  • Verifying the address: before any file can be sent, the relay mails a short document to the address whose title is a six-digit code and the time it was requested, shown in the user’s own time zone and language. Typing that code back proves the user can see that Kindle’s library. Only @kindle.com addresses are accepted.
  • What is sent to the relay: the Kindle address (with the browser’s time zone and language, which only date the code document), when verifying and inside the send token that comes with every send and with Disconnect, and the exported file the user chose to send, with its file name. Only EPUB and PDF files are accepted; other formats are converted to EPUB in the browser first.
  • What the relay keeps: no Kindle address and no file. The relay reads the address from the send token to mail the file and does not store it. The file is held in a temporary folder only while it is being mailed and is deleted right after, whether the send worked or not. Daily limits, which addresses have been verified, which bounced, and anonymous counts are kept under a keyed hash of the address, from which the address cannot be read back. Logs hold a short prefix of that hash, the file’s type and size, the time, and the outcome. The relay sees the network address of each request, as any server does, and uses it only to limit how often one network can send; it is stored only in the same hashed form, for up to 31 days, and up to 14 more days in the relay’s daily backups.
  • Addresses that bounce or complain: when Amazon reports that mail to an address bounced, or that it was marked as unwanted, Amazon Simple Email Service keeps that address on its suppression list for our account, so that nothing more is mailed to it. That list is held by Amazon Web Services, not by the relay.
  • Who else handles it: the relay sends mail through Amazon Simple Email Service (Amazon Web Services), which handles the message to deliver it to Amazon’s Kindle service. From there, Amazon’s own terms apply to documents in the user’s Kindle library.
  • Mail sent to our address: replies to kindle@webtofile.pandaopus.com, and the notices Amazon sends back when it cannot deliver a document (which may name the Kindle address), are received through Amazon Simple Email Service and forwarded to our support mailbox. They are read only to fix delivery problems and deleted once handled.
  • Where it is kept on the device: the Kindle address and a send token, which proves the address was verified, are stored locally in extension storage.
  • Disconnecting: the settings page has a Disconnect button. It deletes the address and token from the device and, when the relay can be reached, cancels the send token there too. Users should also remove kindle@webtofile.pandaopus.com from Amazon’s approved sender list if they no longer want to receive from it.

Google API Services

Web to File’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google is used only to save the user’s exports to their Drive and show the connection status. It is not transferred to anyone, not used for advertising, and not read by people.

What the extension does not collect

Web to File does not gather, retain, or profile user data. Content the user points it at — including a conversation they choose to export — is converted on the device and written to the file they asked for. It is not accumulated, and it is sent nowhere except where the user chooses to send it: their own Google Drive, or their own Kindle through our relay, which deletes the file once it is mailed.

The extension collects no health information, no financial or payment information, no location data, and no browsing history beyond the local record of the user’s own exports. There is no Web to File account. Signing in to Google is needed only for saving to Google Drive, and Send to Kindle needs only the user’s Kindle address.

Data usage and storage

Page content is used solely to support export features: article extraction, full-page capture, custom selection, and AI conversation export. Generated files are downloaded directly to the user’s device; some are stored locally for in-extension viewing.

Local storage on the device, held by the browser and never leaving it, may include:

  • Export preferences and settings
  • Temporary article data for editing/export
  • Export history
  • Exported files kept for in-extension viewing
  • If Google Drive is connected: the account’s email address, the “Web to File” folder’s ID, links to files sent there, and the upload session address of an unfinished send
  • If Send to Kindle is set up: the Kindle address and its send token

Users can remove this data by clearing the export history in the extension’s settings, clearing extension storage, or uninstalling the extension.

Data sharing

We do not sell user data. The extension does not transfer webpage content or browsing data to any server of ours. The only uploads are files the user chooses to send to their own Google Drive or their own Kindle, and only Send to Kindle passes through a server of ours, which deletes the file once it is mailed. The extension does not use analytics, advertising, tracking pixels, or third-party telemetry.

Permissions rationale

This list is exactly what Chrome shows on the extension’s listing. Web to File requests no access to downloads and none to browsing history: files are saved through the browser’s own download flow, so the “Ask where to save each file” setting is respected rather than bypassed.

  • activeTab: run extraction on the page the user is working with
  • scripting: add the extraction tools to the current page when the user starts an export or selection
  • debugger: generate PDFs and capture rendered page regions, only during an export the user started
  • storage: keep preferences and local history
  • sidePanel: provide the extension’s main interface
  • identity: sign in to Google when the user connects Google Drive, with the drive.file permission only
  • <all_urls> host access: run on the pages the user chooses to export, and collect the article’s images for EPUB export, which are usually served from a different domain than the page

Security and remote code

All executable logic ships inside the extension package. The extension does not load external scripts or remote modules.

This website

This policy covers the Web to File extension. The website at webtofile.pandaopus.com is separate and loads no third-party analytics, advertising, or tracking scripts. Like most websites, its server keeps standard access logs (IP address, page requested, timestamp, referrer, and browser user-agent) for security and to understand which pages are useful. These logs are not shared with third parties and are retained for a short period.

Contact

For privacy questions, contact us through the support page or the support channel linked from the Chrome Web Store listing.