Your library, and who can reach it.

Access to your library

• Everything you save is tied to your account. The database enforces this with row-level security, so one person's queries can't return another person's rows.
• There are no shared workspaces, so nobody else can browse your library from inside the app.
• Sign-in uses email and password or Google.

Where files are stored

• Rendered page snapshots and extension screenshots are kept in private storage.
• Screenshots of saved websites are served from storage with long, hard-to-guess web addresses that don't require a sign-in. Anyone with the exact address could open that image, so don't save pages you consider confidential.
• Inspo images are public by design.

Connected AI tools

• AI tools connect through OAuth. You sign in, see what the tool is asking for, and approve or deny it.
• A connected tool runs with your own access, with the same database rules as the app, so it can only see your library.
• You can see and disconnect approved tools on the Connect page.
• Once a tool reads something, that tool's own terms apply to it.

Outside services

Nyabag relies on these services to run. Saved pages and your searches pass through some of them.

How the app protects itself

• Saved addresses must be public web addresses, so the capture system can't be pointed at internal networks.
• Requests are rate limited, identifiers in those limits are stored as hashes, and if a limit can't be checked, the request is refused.
• Telegram link codes and extension sign-in codes are short-lived, and only their hashes are stored.

Deleting things

• Deleting a reference gives you a moment to undo. After that, the row is removed right away, and its stored images and snapshot are cleaned up in the background.
• Deleting a library keeps the references inside it.

Questions