Privacy Policy

Last updated: 2026-05-19

This policy describes what Notchit (the Chrome extension, the embedded website widget, and the app.notchit.io dashboard) collects, why, and how to remove it.

What we collect

Notchit stores the data you actively provide when leaving feedback:

  • Comment content you type, including any rich-text formatting (bold / italic / lists).
  • Page context: the URL of the page you commented on, a screenshot of the visible viewport (only when you click the screenshot button), a CSS selector for the element you pinned, and the viewport size at the time of comment.
  • Attachments: images, voice notes, screen recordings, and document files you choose to attach.
  • Author identity: your account email, your display name, and your avatar URL (if you uploaded one), or a guest name / email if you commented without signing in.
  • Browser context: a user-agent string and the device category (mobile vs desktop) we derive from it. We do not collect IP-address-level fingerprints.
  • Chrome extension session: when you connect the Notchit extension to your browser, we store an encrypted Supabase refresh token and the most recent access token so the extension can authenticate API calls without keeping you signed in via cookies. You can revoke this from the dashboard's Settings page at any time.
  • AI-assisted feedback (opt-in): when you click the “Review” or “Import” button in the widget or extension, we send the relevant input (page screenshots for Review; the image you upload or text you paste for Import) to Anthropic's Claude API to generate findings or extracted tasks. We never send your comment threads, member list, or any project metadata. Anthropic does not retain or train on the inputs (per their zero-retention enterprise tier). You can opt out by simply not using the AI buttons.

What we don't collect

  • We don't read the contents of pages you visit unless you actively pin a comment on them.
  • We don't track your browsing history.
  • We don't use cookies for advertising and we don't share your data with ad networks.
  • We don't collect screenshots automatically - only when you explicitly press the screenshot button.

How we use it

Your comments and attachments are shown to project members on the Notchit dashboard, on the embedded widget, and in the Chrome extension's side panel. The metadata (selector, coordinates, viewport) is used to anchor the comment to the right place on the page when other people view it.

We use the bearer token / refresh token to authenticate your API calls. They are encrypted at rest in our database (AES-256-GCM).

Where we store it

  • Supabase - Postgres database + object storage for comments, attachments (images / voice notes / documents), and user accounts. Stored in the EU region.
  • Bunny CDN - Hosts uploaded screen recordings (videos) for efficient streaming. Files are scoped to a per- project library.
  • Vercel - Hosts the dashboard application + the widget bundle. Vercel may keep short-lived edge logs that include the URLs of API calls.
  • Anthropic - Processes the inputs to the AI Review and AI Import features (page screenshots, uploaded images, or pasted text). Calls are made server-to-server from our Vercel function over TLS; Anthropic operates under their zero-retention API tier so inputs are not stored or used for training.

Third parties

We do not sell or share your data with third parties for marketing. The four vendors above (Supabase, Bunny CDN, Vercel, Anthropic) act strictly as data processors - we control the data, they store / serve / analyze it on our behalf.

Your rights

  • Access: from the dashboard's Settings page you can view all comments you authored across all projects.
  • Delete: the same page lets you delete your account. Deleting your account removes your profile, your comments, your attachments, and the encrypted Chrome-extension sessions tied to your account.
  • Per-comment delete: the dashboard, widget, and extension all let you delete individual comments you authored.
  • Per-browser disconnect: the dashboard's Settings page lists every browser where you connected the extension; revoking one immediately invalidates that browser's bearer token.

Chrome extension permissions

Justifications for every permission the extension requests:

  • storage - store the encrypted bearer token + your RTL/LTR + FAB-corner preferences in the browser.
  • tabs - read the URL of the active tab so the side panel knows which project / page to show. Also used to capture a screenshot of the visible viewport when you press the screenshot button.
  • activeTab - inject the in-page comment popover when you click the floating action button. Active-tab scope means the extension only touches the tab you're currently on.
  • sidePanel - open the comment list / compose view in Chrome's native side panel.
  • scripting - query the active tab to detect whether the Notchit widget is already embedded there (so we can defer to it instead of stacking two FABs on top of each other).
  • host_permissions: https://*\/* - the extension lets you comment on any HTTPS page. We need the broad host pattern so the in-page popover can be injected on the site you're reviewing.
  • host_permissions: https://app.notchit.io/* - calls to the Notchit API endpoints (comments, uploads, project match).

Contact

Questions, deletion requests, or anything else: gabi@manta-web.co.il.