Legal

Privacy Policy & Disclaimer

App Name: Make It Editable•Last Updated:

1. Introduction

Welcome to Make It Editable ("we," "our," or "us"). This Privacy Policy and Disclaimer explain how we handle user data, your responsibilities, and the limitations of our liability. By using the app, you agree to this policy and disclaimer. If you do not agree, please discontinue use.

This policy covers both the Make It Editable Android app distributed on Google Play and the marketing website at makeiteditable.com.

2. About the App

Make It Editable lets you:

  • Enter or paste a website URL and open it in a full-screen WebView.
  • Open multiple tabs and navigate between them.
  • Toggle edit mode, which temporarily applies the contenteditable attribute to the page so you can modify text. All changes are temporary and disappear when the page is refreshed or closed.
  • Apply text formatting (bold, italic, underline, and similar) to the page you are viewing.
  • Replace images on the page with photos from your device's photo library.
  • Take a screenshot of the WebView and either share it via your device's native share sheet or save it directly to your device's photo library.
  • Use built-in developer tools: a network panel, a console logs panel, an element inspector, an in-page HTML and page-source editor, a per-site custom CSS editor, and a JavaScript injection tool.
  • Open an HTML or MHTML page you have saved on your device and edit it in the same way as a live page.

Intended use: entertainment, testing, and demonstrations (for example, previewing content changes before implementing them).

3. Permissions

The app requests the following permissions. We do not use them to collect data about you; they are granted to the underlying OS features the app relies on.

Camera, microphone, and location exist for one reason only: so that the websites you open behave the way they would in any other browser. The app itself never opens your camera, never records audio, and never reads your location — it contains no code that does any of those things. It holds these permissions purely so it can pass a website's request on to Android, exactly as Chrome or Firefox would. Android still shows you its own prompt before any page is granted access, you can refuse or revoke it at any time, and nothing captured this way is ever sent to us, stored by us, or used for analytics, advertising, or profiling of any kind.

  • Photo library — so you can pick an image from your device to replace an image on the page, and so the app can save screenshots you capture to your photo library.
  • Camera — so websites loaded inside the WebView can request camera access (for example, video-calling or QR-scanning pages). Nothing else in the app uses the camera.
  • Microphone / audio recording — so websites loaded inside the WebView can request microphone access (for example, voice-enabled pages). Nothing else in the app uses the microphone.
  • Location — so websites loaded inside the WebView can request your location through the standard browser geolocation API (for example, map and store-finder pages). Nothing else in the app uses your location.
  • Storage (legacy Android 12 and earlier) — to save screenshots, whether through the system share sheet or directly to your photo library.
  • System overlay (Android) — used by the floating toolbar UI.
  • Internet and network state — required for the WebView to load websites.
  • Vibration — for haptic feedback on toolbar interactions.

4. Information We Collect

We do not require registration, login, or any personally identifying information to use the app.

We use PostHog (EU host: eu.i.posthog.com) to collect anonymous product analytics. PostHog assigns a random device ID; we do not link this to your name, email, or other identifiers.

We record screen views and the following events:

  • website_preview_started — includes the URL you entered (origin and path only)
  • settings_opened
  • new_tab_created — includes the new tab URL (origin and path only)
  • tab_closed — includes the number of remaining tabs
  • tab_switched — includes the total number of open tabs
  • screenshot_shared — includes the current tab URL (origin and path only)
  • edit_mode_toggled — includes whether edit mode was enabled or disabled
  • formatting_applied — includes the formatting command used
  • image_replaced — includes the MIME type of the image
  • network_panel_opened
  • logs_panel_opened
  • element_inspector_opened
  • html_editor_opened, html_edit_applied — includes which editor was used (element, page source, or custom CSS)
  • custom_css_saved — includes the length (not the contents) of the CSS and whether it was cleared
  • local_file_opened — includes the file type (HTML or MHTML) and whether it was converted; never the file name or its contents
  • local_file_open_failed — includes the error message
  • user_agent_panel_opened
  • user_agent_changed — includes whether the device default was chosen and the length (not the value) of the user agent
  • bookmark_created, bookmark_updated, bookmark_deleted — includes whether a user agent is set and the number of query parameters; never the name or URL
  • bookmark_opened, bookmark_capture_opened — includes the URL (origin and path only)
  • screenshot_saved — includes the current tab URL (origin and path only)
  • webview_external_handoff — includes the URL the page tried to open (origin and path only) and whether it opened
  • webview_load_succeeded — includes the hostname and the URL (origin and path only)
  • javascript_injected — includes the length (not the contents) of the injected code
  • ai_js_generated — includes the AI provider ID, model ID, and generated code length
  • ai_js_generation_failed — includes the AI provider ID and error message
  • ai_html_edit_generated, ai_html_edit_failed — includes which editor was used and the generated code length (or the error message); never the page content sent to the provider
  • storage_item_set, storage_item_deleted, storage_cleared — includes which storage type was affected (localStorage, sessionStorage, or cookies); never includes keys or values
  • paywall_shown, paywall_dismissed — includes the trigger and outcome
  • purchase_started, purchase_completed, purchase_cancelled, purchase_failed — includes the product ID
  • restore_completed, restore_failed
  • whats_new_completed, whats_new_skipped — includes the app version and, for skips, the step number
  • webview_error_occurred — includes the URL (origin and path only), error code, and error description
  • app_crash — includes the error name and message

PostHog also auto-captures screen views (screenevents) containing the in-app pathname and the previous screen. URLs passed as route parameters are scrubbed to origin and pathname only — query strings and fragments (which may contain tokens or other sensitive values) are never sent.

Performance metrics (EAS Observe). We use Expo's EAS Observe service to collect anonymous app-performance measurements — such as cold and warm launch times, time to first render, time to interactive, and JavaScript bundle load time. These are keyed to an anonymous, installation-specific identifier that is not linked to your name, email, or other identifiers and that resets if you reinstall the app. No page content, edits, or browsing activity is included.

We do not collect the contents of the pages you view, the edits you make, the screenshots you take, the JavaScript you inject, or the network requests and console logs displayed in the developer tools.

Third-party sites in the WebView. Websites you load inside the WebView may set their own cookies, run their own analytics, and request their own permissions. Those activities are governed by the privacy policies of those sites, not by this one.

5. Third-Party Services

PostHog acts as a data processor for the anonymous analytics described in Section 4. Events are sent to PostHog's EU region. See posthog.com/privacy for details.

RevenueCat manages in-app subscriptions and purchase verification. When you purchase or restore a subscription, RevenueCat processes your app user ID and purchase receipt. No payment card data passes through RevenueCat — payment is handled entirely by Google Play. See revenuecat.com/privacy.

AI providers (OpenAI, Anthropic, Google). The AI assistants are optional features that require you to supply your own API key in Settings. When you use one, the request is sent directly from your device to your chosen provider.

What is included in an AI request. Alongside the instruction you type, the request contains the content you asked the assistant to work on, taken from the page you are viewing:

  • HTML editor — the HTML of the element you selected, or the full page source if you are editing the whole page.
  • Custom CSS editor — the custom CSS you have written for that site.
  • JavaScript assistant — your instruction only.

This content is truncated to 30,000 characters and is sent only when you actively submit an AI request — never in the background and never for pages you simply view. If the page you are editing contains personal or confidential information, that information will be part of the request. We do not proxy, store, or log these requests; they go straight from your device to the provider. The API key itself is stored only in your device's secure keystore and never transmitted to us. Refer to your provider's own privacy policy for how they handle API requests.

Google Play distributes the app and processes subscription payments. When you install, update, or purchase a subscription, Google Play processes data in accordance with its own policy: Google Privacy Policy.

Expo / EAS Update. The app checks for over-the-air updates via Expo's EAS Update service (u.expo.dev). This request includes device and build metadata needed to serve the correct update bundle. See expo.dev/privacy.

Expo / EAS Observe. The app sends the anonymous performance metrics described in Section 4 to Expo's EAS Observe service. See expo.dev/privacy.

No advertising networks or ad SDKs are integrated.

6. Security & Local Storage

Your edits and screenshots remain on your device unless you choose to share them through the system share sheet. We do not upload them and do not have access to them.

The app stores the following data locally on your device:

  • @whats_new_version — which version of the "What's New" screen you last saw.
  • @toolbar_intro_shown — whether the toolbar intro screen has been shown.
  • @developer_mode_unlocked — whether the developer tools have been unlocked.
  • @bookmarks — your Quick Access entries: the name, URL, query parameters, user agent, and favicon URL you saved for each one.
  • @user_agent_override — the user agent you chose to present to websites, if you set one.
  • @custom_css_by_origin — the custom CSS you have written, stored per website origin so it can be re-applied when you return to that site.
  • @ai_active_provider, @ai_model_* — which AI provider and model you selected.
  • Locally opened pages — when you open an HTML or MHTML file from your device, a copy is placed in the app's own cache directory so the in-app browser can load it. It stays on your device, is never uploaded, and is removed when you clear the app's data or the operating system reclaims the cache.
  • AI provider API keys — if you set up an AI assistant, your API key is stored in your device's secure keystore (iOS Keychain / Android Keystore). It is never transmitted to us and is only used to make requests directly to your chosen AI provider.

None of this data is transmitted to us or to any third party. Some of it — a bookmarked URL, or a page you opened from your device — may contain information that is personal to you; it stays on your device, and clearing the app's data removes it.

7. Your Rights (GDPR)

Data controller: the developer of Make It Editable, reachable at tomislav@horseandradish.hr.

Legal basis. We rely on our legitimate interest (GDPR Art. 6(1)(f)) in understanding product usage and diagnosing errors to process the anonymous analytics described in Section 4. Distribution through Google Play is processed on the basis of contract performance.

Retention. Anonymous analytics events are retained for up to 12 months and then deleted or aggregated by PostHog in line with our project configuration. Local device storage is retained until you clear the app's data or uninstall the app.

Your rights. Subject to applicable law, you have the right to access, rectify, erase, restrict, object to, and port the personal data we process about you. Because analytics are tied only to a random device ID, requests to exercise these rights may require you to provide that device ID (available on request) so we can locate the relevant events.

How to exercise your rights. Email us at tomislav@horseandradish.hr. We respond within 30 days.

Right to complain. You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) at azop.hr, or with the supervisory authority in your country of residence.

8. Children's Privacy

Make It Editable is not directed at children under the age of 13 and we do not knowingly collect personal data from children. If you believe a child has used the app and would like their associated anonymous analytics data deleted, contact us at tomislav@horseandradish.hr.

9. User Responsibilities

  • Use the app only for lawful, ethical, and personal purposes.
  • Do not use the app to spread misinformation, commit fraud, or violate the rights of others.
  • You are solely responsible for the websites you choose to edit, the modifications you make, the code you inject, and any screenshots you create or share.
  • Misuse may result in access being blocked at the developer's discretion.

10. Disclaimer

The app is provided "as is" and "as available." We make no warranties regarding accuracy, reliability, or fitness for a particular purpose. We are not liable for any damages, legal issues, or disputes arising from your use of the app, including misrepresentation of edited content.

11. Governing Law

This Privacy Policy and Disclaimer are governed by the laws of the Republic of Croatia. Any disputes will be resolved in the courts of the Republic of Croatia.

12. Changes to This Policy

We may update this page from time to time. Material changes will be reflected by an updated Last Updated date above. Where required by law, we will seek your consent.

13. Contact Us

Questions about this policy? Email us at tomislav@horseandradish.hr.