NoizWorks privacy policy

Updated November 4, 2026

NoizWorks is the name used by independent developer fs0x1337 (xhthc on GitHub). This shared policy describes the NoizWorks website, contact channels and the projects explicitly listed below. Product-specific sections explain the data each project handles; they do not imply that every project uses the same services or permissions.

NoizWorks website and contact channels

This site is hosted by GitHub Pages. It contains no analytics, advertising scripts, tracking pixels or account sign-in form. The hosting provider receives the network information needed to serve the site under GitHub’s privacy statement. External links, including GitHub, Bio and Boosty, lead to services with their own policies.

If you contact the maintainer by email or open an issue, the maintainer receives the address or account name and the information you choose to send, and uses it to handle your request. Email and issue-hosting providers process those messages under their own policies. Public issues are visible to others; never include passwords, tokens or private media.

MediaLatch

MediaLatch is a browser extension maintained by fs0x1337 (xhthc on GitHub) through NoizWorks. It helps you save accessible media, organize files, manage downloads and copy supported post links. This section covers the extension; the shared website notice above also applies when you visit its product page. Features depend on your installed build: the published GitHub 3.0.7 package includes Google Drive and Yandex Disk; the development build also includes MEGA and Telegram posting. All account connections are optional.

Media and browsing context

When you use MediaLatch, the extension processes the selected page, media addresses and available post metadata to identify the requested media and download it. This can include a posting account, publication date, filename and source website. Requests go to the relevant website, service or CDN. The extension does not bypass sign-in requirements, DRM or the source service’s access controls.

Information stored on your device

Settings, download records, queue state, optional statistics, cached previews and optional diagnostic events are stored in your browser profile. MediaLatch does not operate a server that receives your browsing history, statistics or diagnostics. Preview caches have size and lifetime limits and can be removed by the browser. Exported media stays in the destination you selected.

You can clear records, statistics and diagnostics using the extension’s controls. Removing a history record does not delete the saved media file. Settings and history exports are created only at your request. They do not contain cloud access tokens. Review any diagnostic report before sharing it.

Optional cloud destinations

Connecting Google Drive or Yandex Disk is optional. Local saving remains available. A cloud save sends the selected media bytes, filename and destination folder structure directly from your browser to the chosen provider. MediaLatch has no server between your browser and your cloud account. Existing cloud files are not made public by the extension.

Connected accounts may provide total and used storage for the advisory free-space display. Yandex email (login:email) is optional during sign-in. Disk information (cloud_api:disk.info) uses a separate optional consent action. Missing or declined values do not prevent local saving. Capacity and account labels stay in your browser profile and are excluded from settings, history and diagnostic exports.

Google Drive

Google sign-in requests https://www.googleapis.com/auth/drive.file, which permits access to the specific Drive files used with the application. MediaLatch creates a MediaLatch folder and the subfolders needed for the layout you select. It uses Drive account identity, including the account’s permission identifier and an available email or display name, to identify the connected account and prevent uploads to a different account.

Advanced manual access tokens may have broader permissions, depending on the application and permissions used to obtain them. Their issuing application remains part of the destination identity. A token issued to another application may not see the same files or folders.

Yandex Disk

The Yandex integration requests access to the application’s folder through cloud_api:disk.app_folder. It uses Yandex account and application identity to keep saves bound to that connection. Your selected media and folder names are sent to Yandex when you choose that destination.

Credentials and disconnection

Native Google credentials are managed by the browser. Credentials obtained through the extension’s browser OAuth flow, and tokens you paste manually, are held in extension-private IndexedDB. They are sent only to the relevant provider for authentication and requested operations, and are excluded from settings exports, history exports and generated diagnostics.

Disconnecting forgets the extension’s stored connection. For Google OAuth connections, MediaLatch also attempts to revoke the credentials it obtained. Yandex credentials and manually supplied tokens are forgotten locally; remove the provider-side permission in your Google or Yandex account settings when you want to revoke that access. Disconnecting does not delete previously uploaded files. Expired or revoked credentials require reconnection.

MEGA in development builds

MEGA sign-in uses your email, password and, when required, a two-factor code. The password is used for sign-in and is not saved. The account session is encrypted in this browser profile. Account login permits access to your MEGA account; MediaLatch creates encrypted uploads of selected files inside its MediaLatch folder. Account labels and capacity are used to display the connection. Disconnecting forgets the local session; revoke sessions in MEGA when provider-side revocation is needed.

Local credential encryption reduces accidental plaintext exposure. It does not protect against malicious code running inside the extension, a compromised browser profile or a compromised operating system.

Telegram posting in development builds

You can connect a Telegram bot using its token and choose a channel where the bot has permission to post. MediaLatch sends the bot token only to Telegram for authentication and the requested operations. The token is stored as a private connection credential in the browser profile and is excluded from data exports and diagnostics.

Draft text, source links, credits, channel choices and attached media are staged locally. Creating, previewing or saving a draft does not publish it. Publishing or choosing Telegram as a save destination sends the selected content to Telegram and your chosen channel. Telegram controls the final appearance and may transform media; document mode preserves the uploaded file. Deleting a local draft does not remove a message already sent to Telegram.

Disconnecting forgets the local bot connection. Revoke the token through Telegram’s BotFather if you need to invalidate it at Telegram. MTProto user-account sign-in and Telegram-native scheduling are planned but are not implemented in the current development build.

Use of Google user data

MediaLatch uses Google user data only to provide the cloud-saving functionality you request, show the connected account and maintain the correct destination. It does not sell Google user data, use it for advertising or use it to train AI models. MediaLatch’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Other network requests and sharing

Checking available releases contacts GitHub. Copying a preview link constructs an address for your chosen service; when that link is opened or shared, the preview service and destination app handle their own requests and policies. MediaLatch does not automatically send diagnostic exports to the developer. If you share a report by email or GitHub Issues, that service processes the information you submit.

Future NoizWorks projects

Future projects will be added to this policy with their own data, storage, sharing and deletion details before they are offered here. A project may instead link to a separate privacy notice when its behavior requires one. The MediaLatch permissions and integrations described above apply only to MediaLatch, not automatically to future projects.

Changes, questions and deletion requests

This policy will be updated when relevant behavior changes or a project is added, with the update date shown above. The extension’s store disclosures and documentation should describe the version you install. Contact always1337@vk.com for privacy questions or private security reports. For a request about information you sent to the maintainer, name the project and the relevant message without sending credentials. Local extension data can be cleared using the controls described above; uploaded files and published messages must also be managed at the destination provider. Public MediaLatch bugs and questions can be filed in GitHub Issues.