Privacy Policy

1. Overview

PagePin AI is a Chrome extension that lets users annotate website elements, capture screenshots, export visual feedback as Markdown, and optionally generate implementation plans using an AI provider chosen by the user. Its core annotation workflow is designed to work completely locally on your machine without requiring an account or sign-in.

2. Information Processed

When you use PagePin AI, the extension processes the following information strictly on your local device from the webpages you elect to annotate:

• Page Information: Page URL, origin, and title.
• DOM & Technical Metadata: CSS selectors, XPath, test IDs, tag names, accessible names, element attributes, sanitized HTML snippets, bounding box dimensions, and element styles.
• User Annotations: Your written comments, severity level, intent, tags, and timestamps.
• Screenshots: Visual captures of the target element or active viewport captured via Chrome's tab capture API upon your action. Screenshots may contain confidential or personal information displayed on the annotated webpage; they are stored exclusively on your device.
• Optional Console Logs: If you explicitly enable console capture, the extension may capture console logs, warnings, errors, and timestamps from the active tab. Console capture is strictly off by default.
• AI Configuration: User-configured provider profiles, endpoints, model names, and optional API keys.

3. Storage and Retention

• Local IndexedDB: Annotations and screenshot image data are saved locally in your browser's IndexedDB.
• Local Extension Storage: User preferences and AI provider settings are saved in chrome.storage.local.
• Session Storage for API Keys: API keys are stored in chrome.storage.session, an in-memory storage cleared automatically when the browser session ends. They are never written to disk or included in exported reports.
• No Remote Databases: PagePin AI operates no remote servers, user databases, or centralized storage for your annotations.
• Data Retention & Deletion: Local data remains in your browser until you delete specific annotations, click "Wipe Data", or uninstall the extension. Downloaded Markdown reports and PNG screenshot files saved to your disk are managed by your operating system and must be deleted manually if no longer needed.

4. AI Providers and Network Transmission

PagePin AI does not transmit data over the network during normal annotation or export operations. Network requests only occur when you explicitly trigger an AI feature:

• User-Initiated: Network calls to an AI provider only happen when you click an action such as testing a provider connection, improving a comment, or generating an implementation plan.
• Data Sent to AI: When you execute an AI request, only textual annotation context (feedback comments, intent, severity, tag names, CSS selectors, XPath, text snippets, or formatted Markdown structure) is sent to the configured endpoint.
• Screenshot Images Are NOT Transmitted: PagePin AI does not transmit binary screenshot image files to AI completions endpoints.
• Choice of Provider: You choose where requests are sent. If you configure a cloud AI provider (e.g., OpenAI or an OpenAI-compatible remote service), transmissions are governed by that provider's privacy policy. If you configure a local provider (e.g., Ollama or LocalAI on localhost), data never leaves your computer.
• Cloud Confirmation: The extension requires explicit confirmation before sending feedback text to remote cloud endpoints.

5. Sharing and Disclosure

• Zero Analytics & Tracking: PagePin AI contains no tracking libraries, telemetry services, third-party analytics SDKs, advertising scripts, or tracking cookies.
• No Sale or Transfer: We never sell, rent, monetize, or transfer user information to data brokers or third parties.
• Direct Sharing Only: Your feedback is only shared when you manually copy it to your clipboard, download it as a file, or invoke your selected AI provider.

6. Chrome Permissions Justification

PagePin AI requests only the permissions necessary to deliver its core functionality:

7. Security

PagePin AI follows defense-in-depth and the principle of least privilege:

• Strict Content Security Policy (script-src 'self'; object-src 'self') prevents injection of remote scripts.
• API keys are stored strictly in session memory and excluded from export outputs.
• All communication with remote AI endpoints requires HTTPS encryption.

8. Your Choices and Controls

You have complete control over your data and environment:

• Use the extension completely offline without configuring any AI provider.
• Keep console capture disabled (default setting).
• Delete individual annotations or wipe all local extension data at any time.
• Revoke site permissions or uninstall the extension via Chrome's extensions manager (chrome://extensions).

9. Children's Privacy

PagePin AI is a developer and design productivity tool. It is not directed to children under the age of 13 (or under 16 in the European Union), and does not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in extension functionality or regulatory requirements. Any updates will be posted to this page with an updated effective date and version number.