Privacy policy
Effective October 11, 2026.
Annotate is the website at annotate-app.fly.dev and the extension that connects Chrome to it. This policy says what leaves your browser, where it goes, what Annotate keeps, and for how long.
What leaves your browser
Annotate's server gets these when you send a frame, dictate a note or send feedback.
- A frame: the picture of the part of the page you framed, your note, the files you add to it, and the page's address and title.
- Your voice, while you dictate a note on a frame's card, to turn it into words.
- Feedback, when you send it; see Feedback below.
Where it goes
- Annotate's server, in the United States, on a hosting provider.
- Your agent, Claude Code or Codex: the frames you send it, which it fetches from Annotate's server with the token you gave it.
- A speech service, on Annotate's own account: your voice, to turn it into words.
- An email service: your email address, when you join the waitlist (to confirm it, and to tell Annotate that you joined) and when Annotate invites you (with your invite code and a link to sign in); and what you send in Feedback, which reaches Annotate by email.
- Google or GitHub, when you sign in with one of them.
What the hosting provider, the speech service and the email service keep is governed by their own terms.
What Annotate keeps
On the server, for your account: each frame you send, with its picture, note and files, the page's address and title, and what your agent said it did with it.
In Annotate's database, for each account: how you signed in, Google or GitHub, with the account number and email address that came with it; when you joined, last signed in and were last active; a hash of each session and of the invite code you used.
What Annotate counts
Annotate counts, for your account, how you use it: each frame you send and whether it was picked up and done; each time a frame card opens; each call Claude Code or Codex makes to Annotate, by tool, with its errors and how long it took; each setup step that worked; each time your invite link was opened; and any server errors. It shows only those counts to the person who invited you, never what you write or capture. Annotate keeps those counts with no end date, and deletes them only if you close your account.
How long it is kept
Your frames are kept until you delete them. Your account record is kept while you have an account.
Deleting a frame
On the frames page, open a frame's ⋯ menu and press Delete, then Delete again to confirm. The frame, its note and its files are deleted from the server right away. What you sent with Feedback is kept separately; see the Feedback section below.
Logs
The server keeps a working log so that faults can be found. It records what the server did and when, with counts and lengths, never what you say, type or show, the names of your files, or your API key. How long the log is kept is governed by the hosting provider's terms.
The waitlist
If you join the waitlist, from the website or the extension, Annotate keeps your email address, when you asked to join and from which of the two, when you confirmed it, and when you were invited. Annotate emails you once to confirm the address, and Annotate also gets one email saying that you joined. Your address is used only for these emails and to send you an invite code. It is deleted when you sign up with that address; until then it stays on the list.
To slow down abuse, the server counts the asks from each internet address in its memory, never in its database, and allows ten an hour.
Feedback
When you press Send in Feedback, Annotate gets what you write, the files you add, your email address, the version of Annotate you use and the page you sent it from. Feedback reaches Annotate by email and is kept on Annotate's server until Annotate deletes it; to have yours deleted, ask for that in Feedback.
Sign-in
Annotate signs you in with Google or GitHub. From Google it asks for your email address and account number. From GitHub it asks to read your profile and email addresses. From either, it keeps only your account number and one email address.
The first sign-in needs an invite code. Annotate stores a hash of the code, never the code itself, and a hash of each session.
Signing in sets three cookies on the website. One keeps you signed in for 90 days. One holds a sign-in while it finishes and lasts 10 minutes. One lasts a year and holds only the fact that this browser has signed in before, so the website takes you to sign-in instead of asking for an invite code. Pressing Sign out, in Settings › Account or at the top of the website's pages, deletes your sign-in session from the server and ends the 90-day cookie.
What Annotate can see about each account
Annotate can see the invites made, used and revoked, and the email addresses on the waitlist with when each asked and whether from the website or the extension. For each person, Annotate can see how they signed in, their email address, when they joined, when they last signed in and were last active, and the counts above. It does not look at the pictures, notes or files in their frames.
The extension's permissions
When you add the extension, Chrome asks you to let the extension read and change your data on annotate-app.fly.dev, Annotate's own website, and to view and manage your tab groups, for its purple Annotate group. The extension also gets its own storage, a place in Chrome's side panel, and permission to run its scripts in the pages it has access to. At that point it has access to no other website.
A click on the extension's toolbar button, or ⇧⌘E, opens Annotate in Chrome's side panel. The extension needs no access to every site for this.
Access to every site is optional, and Chrome asks you before Annotate gets it. Annotate uses it to take a screenshot of a page when you press ⇧⌘F there, and sees a page only when you press one of its keys there.
The extension's storage, on this computer, holds how the extension looks, as the website sets it: its icon, tooltip, tab group and outline.
Closing your account
To close your account, ask for it in Feedback. Annotate then deletes your account record and everything else it keeps for your account.
Nothing else
Annotate has no analytics and no advertising, sets no cookies beyond the three above, and sells nothing. It shares what you send only with the services above, to do what this page says, or where the law requires it.
Children
The person who holds an account must be 13 or older.
Changes
When this policy changes, the date at the top changes. The newest version is always at this address.
Contact
Questions about this policy: write to Annotate through Feedback on the website.