Privacy Policy

When you sign in using Google OAuth, we receive and store:

We do not receive or store your Google password. Authentication is handled entirely by Google's OAuth 2.0 service.

When you use the Extension while signed in, requests to annotamark.com may include your existing authentication session cookie so we can verify your account, subscription status, and cloud sync access. These authentication cookies are sent only to AnnotaMark API endpoints.

When you use the Extension or Website, we may store:

• Annotations: Highlights, drawings, shapes, sticky notes, text annotations, and other visual markup you create on web pages.
• Whiteboards: Drawings, shapes, text, and other content you create on whiteboards.
• Page metadata: The URL and page title of web pages you annotate, used to organize annotations in the dashboard.
• Annotation settings: Your tool preferences, colors, and configuration choices.

Important: On the free plan, annotation data is stored locally in your browser. On the Premium plan with cloud sync enabled, annotation data is transmitted to and stored on our servers.

When you subscribe to a paid plan, our payment processor, Dodo Payments, collects payment method details, billing address, and transaction history.

We do not store your full payment card details. All payment information is processed and stored by Dodo Payments in accordance with PCI DSS standards. We receive only a customer identifier and subscription status from Dodo Payments.

We automatically collect limited technical data when you use the Service:

• Server logs: IP address, browser type, operating system, request timestamps, and HTTP referrer.
• Error reports: Technical error information when something goes wrong, used solely for debugging.

We want to be clear about what we do not do:

• We do not track your general browsing activity. The Extension checks tab URLs only for explicit AnnotaMark launch markers and processes page content only when you use annotation tools.
• We do not sell your personal data to third parties.
• We do not use your data for advertising or ad targeting.
• We do not use your annotation content to train machine learning models.
• We do not collect keystroke data, form inputs, or passwords from web pages.
• We do not use third-party analytics trackers, advertising pixels, or social media tracking scripts.

• Account data and annotation metadata: Stored in our application database, hosted on secure servers.
• Annotation and whiteboard files: Stored on Cloudflare R2, a globally distributed object storage service.
• Payment data: Stored by Dodo Payments on their secure, PCI-compliant infrastructure.

We implement the following security measures:

• Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher (HTTPS).
• Encryption at rest: Stored data is encrypted using industry-standard encryption.
• Access controls: Access to production systems is restricted to authorized personnel with a legitimate need.
• Security headers: We implement HSTS, Content Security Policy, X-Frame-Options, and other HTTP security headers.
• Regular updates: Dependencies and infrastructure are regularly patched and updated.

In the event of a data breach that is likely to affect your rights and freedoms, we will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

We may disclose your data if required to do so by law, court order, or government regulation, or if we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation.
• Protect the rights, property, or safety of AnnotaMark, our users, or the public.
• Detect, prevent, or address fraud, security, or technical issues.

When you delete your account:

1. Your account data, including name, email, and profile picture, is deleted immediately.
2. Your annotations and whiteboards stored in cloud sync are deleted within 30 days.
3. Billing records may be retained for up to 7 years for legal and tax compliance.
4. Server logs containing your IP address are automatically purged within 90 days.

To delete your account, visit your dashboard settings or contact us at support@annotamark.com.

If you are located in the European Economic Area (EEA), you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your personal data.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to our processing of your data based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint: File a complaint with your local data protection authority.

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Request information about the categories and specific pieces of personal data we collect.
• Right to delete: Request deletion of your personal data.
• Right to opt-out:We do not sell personal data, so this right does not apply. If we ever change this practice, we will provide a "Do Not Sell My Personal Information" option.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of the rights listed above, contact us at support@annotamark.com.

We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

• We do not use advertising cookies.
• We do not use third-party tracking cookies.
• We do not use analytics cookies such as Google Analytics or Mixpanel.
• We do not use social media cookies or pixels.

Because we only use essential and functional cookies, we do not display a cookie consent banner. If we add non-essential cookies in the future, we will update this policy and implement appropriate consent mechanisms.

The Extension requests the following browser permissions:

• The Extension does not run a static content script on every page. It injects the annotation toolbar when you enable it or when a page URL contains an explicit #annotamark launch marker.
• The Extension processes web page content only when annotation tools are enabled on a page.
• On the free plan, all annotation data stays in your browser's local storage. No data is sent to our servers.
• On the Premium plan with cloud sync, annotation data and the URL/title of annotated pages are transmitted to our servers over encrypted connections (HTTPS).
• The Extension does not collect browsing history, form data, passwords, or any data from pages you do not annotate.

The Extension complies with the Chrome Web Store Developer Program Policies, including the limited use requirements for user data.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.