Privacy Policy

Last updated: October 24, 2026

Clowder Nine is the umbrella for a small suite of browser extensions. This page covers the suite as a whole and then each extension in turn.

Across every Clowder Nine extension:

There is no analytics, telemetry, advertising or crash reporting of any kind.
We do not sell, rent or share your personal information with anyone.
We operate no server, Worker or proxy that your data passes through. Requests go directly from your browser to the service you are using.
We have no account system and no database. There is nothing on our side holding your data.

Questions about anything on this page: admin@sndcats.com.

IconCat

IconCat is a browser extension for finding, drawing and managing icons, with optional connections to your own Google Drive and Microsoft OneDrive so you can store your work there.

IconCat is entirely client-side. Every request it makes goes straight from your browser to Google, to Microsoft, or to the icon source you selected. Nothing is routed through a server of ours, because there isn't one.

Google user data

IconCat requests a single Google OAuth scope:

https://www.googleapis.com/auth/drive.file

This scope grants access only to files that IconCat itself created or that you explicitly opened with it. IconCat does not request drive.readonly, full drive access, or any other Google scope, and so it cannot see the rest of your Drive.

Why: so that your IconCat drawings and exports can be saved in, and reopened from, your own Google Drive rather than anywhere belonging to us.

What IconCat writes to your Drive:

IconCat drawings, saved as SVG files with the layered drawing embedded in the SVG.
Exports you choose to create (SVG, PNG, JPG, PDF and the other supported export formats).
An IconCat folder at the top level of your Drive, plus subfolders for Files exports.
File renames you make.
Sharing changes, only when you use the Share feature: adding people by email address, enabling link sharing, or changing or removing someone's access.

What IconCat reads from your Drive:

Its own list of files.
File contents, in order to open or import a file.
File details: name, version, last-modified time and web link.
Who currently has access to a file.
Your Google account's email address and display name, used only to show which account is signed in.

Autosave overwrites the same Drive file each time. Google Drive keeps earlier versions in its own file history, under your control.

Files move only between your browser and your own Google Drive. They are not copied to us, and they are not sent to any third party.

IconCat's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft OneDrive

IconCat requests these Microsoft Graph scopes: openid, profile, offline_access, User.Read and Files.ReadWrite. All are delegated permissions, acting only as you. IconCat is registered as a public client with no client secret and holds no application permissions.

Please note that Files.ReadWrite covers your entire OneDrive, not only an app-specific folder. Microsoft does not offer a narrower file-scoped equivalent to Google's drive.file, so this is the permission IconCat must request in order to let you browse and save. In practice IconCat uses it to browse your drive and your "Shared with me" items so you can pick a location, and to save its own files into an IconCat folder. It does not read or copy your unrelated OneDrive files for any other purpose, and nothing from your OneDrive is sent to us.

Why: the same reason as Drive. So your drawings and exports live in your own OneDrive rather than with us.

As with Google, files move only between your browser and your own OneDrive.

Icon search and the sites it contacts

IconCat searches icon sources that you select. Which sources are contacted, and when, depends on your settings:

Starter — bundled with the extension. Works offline and makes no network request at all.
Iconify (api.iconify.design) — on by default, and can be turned off in Settings.
svgl (api.svgl.app) — contacted when it is the selected source.
SVGFind (svgapi.com) and any custom API you add — only if you set them up yourself with your own key or header.

Search is as-you-type, firing after a brief pause, which means partial search terms are sent to the selected source as you type them.

svgl can be contacted with no search text. When svgl is the selected source and the Search tab loads, IconCat requests its list of popular logos without sending any search term. Because IconCat remembers your last-used source, this request can happen simply when IconCat opens.

Separately, IconCat can hand a search off to an icon or logo website — Flaticon, Icons8, IconScout, Streamline, SVG Viewer, VectorStock, svgfind.com, BrandLogos, LogoDix and Worldvectorlogo. This happens only when you press Enter or pick the site. IconCat opens that site in an ordinary browser tab, either with your search in the address or typed into the site's own search box. From that point you are on their website, under their privacy policy.

Every one of these requests goes directly from your browser to the source. None pass through us.

Search terms

IconCat does not log or store your search terms. The text in the search box is not saved, and the Activity panel exists in memory only and is cleared when the page closes.

What the services receiving those searches do with them is governed by their own privacy policies, not by ours. If you would rather not send search text off your device, the bundled Starter source works entirely offline, and Iconify can be turned off in Settings.

Sign-in tokens and what is stored on your device

Sign-in tokens are held in the browser's own extension storage (storage.local, under the key cloudAuth) on your device. They are never sent to us, because there is nowhere of ours to send them.

Google: a short-lived access token only. No refresh token is stored; access is renewed silently through Google's sign-in.
Microsoft: an access token plus a refresh token.
The signed-in account's email address and display name are stored alongside them, so IconCat can show you which account is connected.

Tokens are transmitted only to Google (accounts.google.com, www.googleapis.com, oauth2.googleapis.com) and Microsoft (login.microsoftonline.com, graph.microsoft.com). Nowhere else.

IconCat also keeps the following on your device, in extension storage:

For each open tab linked to a cloud file: the provider, file ID, name, path, web link, version and last-synced time. If you loaded sharing details, also who shared it and the names and email addresses of people with access. This is kept until you close that tab.
A record of the last 200 cloud files saved or opened: file ID, version number and a content fingerprint. No file names and no file contents. These records have no expiry and are replaced as newer files come in.
Changes waiting to upload: the drawing and the file's details, kept until the upload completes.
Cloud file lists shown in the Open and Import windows exist in memory only and are not saved.

IconCat does not fetch or store thumbnails from Drive or OneDrive.

Other data that leaves your device

All of the following are things you start:

The Page tab reads images from the site you are currently on, including through the extension's background script, using that site's cookies. That means those requests are made as your logged-in self on that site, the same as if your browser loaded the image normally.
Loading site icons from SiteDrawer tile addresses.
Opening icon sites in browser tabs, as described above.
Share invitations: email addresses you type are sent to Google or Microsoft in order to grant access.

Communication between IconCat and SiteDrawer happens inside your browser, directly between the two extensions. Nothing leaves your device. Fonts are bundled locally and the PDF engine (pdf.js) ships with the extension, so neither causes an external request.

Telemetry

None. IconCat contains no analytics, no usage tracking and no crash reporting.

Disconnecting and removing access

Inside IconCat, go to Settings › Cloud Account Settings › Disconnect for each account.

Google: Disconnect deletes the local token and revokes it with Google.
Microsoft: Disconnect deletes the local tokens, but does not make a revoke call to Microsoft. The refresh token remains valid at Microsoft until it expires or until you remove the app's access yourself. To fully revoke it, remove IconCat at account.live.com/consent/Manage for a personal Microsoft account, or at myapps.microsoft.com for a work or school account.

Uninstalling IconCat causes the browser to delete all of its extension storage, including tokens, Files, settings and the cloud records listed above. IconCat performs no additional action on uninstall. To be certain that IconCat's access to your Google account has also been withdrawn on Google's side, remove it at myaccount.google.com/permissions.

Selling and sharing

IconCat does not sell, rent or share your information, and it transfers nothing to third parties beyond the direct, user-initiated requests described on this page.

SiteDrawer

SiteDrawer is a toolbar launcher that organizes your favorite sites into Spaces. Like the rest of the suite, it has no analytics and no trackers, and we operate no server that your data passes through.

The full SiteDrawer privacy policy is published alongside the extension:

sitedrawer.net/privacy.html

Changes and contact

If this policy changes, the "Last updated" date at the top of the page changes with it. For questions about this policy or about any Clowder Nine extension, write to admin@sndcats.com.