Privacy Policy

This policy describes the Annota browser extension for ChatGPT Web, the Annota backend service the extension talks to, and this website at annota.io.

It does not describe ChatGPT. ChatGPT is operated by OpenAI, Annota is not affiliated with OpenAI, and your use of ChatGPT is governed by OpenAI’s own terms and privacy policy. Annota runs as an extension on top of the ChatGPT web interface in your own browser.

Annota is pre-release. The extension is not published on the Chrome Web Store, and no paid plan is offered or sold.

Annota injects its interface into ChatGPT web pages. Its content script runs only on https://chatgpt.com/* and https://chat.openai.com/*, and the extension does not request access to any other site.

To do its job the extension reads what is already on screen in your browser: the message you select and the text around it, the identifiers the page assigns to that conversation and message, and — to draw the chat-folder interface — the titles and identifiers in your ChatGPT conversation list. That reading happens in your browser.

Reading the page is not the same as storing it. Annota writes a conversation down only where you ask it to: by saving a highlight, a bookmark, a note or a task, or by filing a conversation into a folder. It does not copy your conversation history in the background.

When you save something, Annota records it as a saved item. A saved item can contain:

• its type — highlight, bookmark, note or task;
• the text you captured;
• a title, your own note, a task status, and any tags you add;
• creation and update timestamps;
• source information describing where it came from.

The source information can include:

• the provider and the conversation URL;
• the conversation title and conversation identifier;
• the message identifier, the role of the message (yours or the assistant’s), its position in the conversation, and the position of the passage within the message;
• hashes of the selected passage and of the text immediately before and after it, used to find the passage again if the page changes;
• a short fallback excerpt, kept so a saved item still shows its context when the original conversation can no longer be reached;
• the timestamp of the source message and the version of the resolver that recorded it.

None of this is harmless technical metadata by default. A conversation URL, a title, an excerpt or a captured passage can contain anything you discussed with ChatGPT, including personal or sensitive information. Annota treats all of it as your content.

Prompt templates you create, and the composer drafts the extension keeps while you are writing, are treated the same way.

Saved items, prompt templates and composer drafts are encrypted on your device and written as ciphertext into a local database in your browser named annota_secure_vault. They are stored on your machine. Storing them does not send them anywhere.

The mechanism is described in Encryption and key handling below.

Not everything Annota keeps on your device is inside the encrypted record store. This section exists so that distinction is visible rather than glossed over.

Stored locally in ordinary extension storage:

• Your settings and preferences — theme, typography and layout, notification preferences, language and text-direction options, and the privacy options described below.
• Device state — an identifier generated on your device and a key pair generated on your device.
• Account session — the session token issued after you sign in, and the basic profile the sign-in returned.
• The sync recovery phrase, if you have set up cloud synchronisation. This is key material and it is kept on your device; see Encryption and key handling.
• Cached operational data — the last version/compatibility response, the cached interface-selector configuration, and the time of the last successful synchronisation.

Stored locally in a second, separate browser database named chatgpt_workspace_db:

• Chat folders — the folders you create to organise your ChatGPT conversation list, including the names you give them.
• Chat-to-folder mappings — which ChatGPT conversation identifier you filed in which folder.

These folder records are not encrypted. A folder name is text you wrote, and a conversation identifier points at a specific ChatGPT conversation, so this is information about your work even though it holds none of the conversation text itself.

Annota uses an Annota account, and Google is the only way to sign in to one. Signing in opens an Annota page hosted on Google Firebase Hosting, which uses Firebase Authentication and Google as the sign-in provider. That page loads Google’s authentication libraries from Google-hosted infrastructure.

The sign-in requests only your basic Google profile and email address. It does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service, and Annota cannot reach them.

After sign-in, an account record can hold: an Annota user identifier, your Firebase user identifier, your email address, your display name, your avatar URL, a device identifier generated on your device, a plan and role value, cryptographic material related to your device key and recovery, and account timestamps.

Annota does not receive your Google password, and signing in with Google does not give Annota your Google account.

Cloud synchronisation is off by default. The extension ships with its data mode set to local-only, and the synchronisation worker does not start unless you change that setting and complete the sync setup, which generates a recovery phrase.

When you do enable it:

• The payload is your saved items and prompt templates. Composer drafts are not part of it.
• That payload is encrypted inside the extension, using a key derived from your recovery phrase, before any upload happens.
• What is sent to the Annota service is the encrypted payload, the nonce needed to decrypt it, and a hash of the payload used to detect whether the copies differ.
• The service stores, for your account: the encrypted payload, the nonce, the hash, a version number, its size, and timestamps. The vault table it is stored in has no column for readable saved-item content.
• While synchronisation is enabled the extension keeps a real-time connection open to the service so that a change made on one device can be pulled by another.

Turning synchronisation off stops new uploads. It does not by itself delete what was already uploaded — see Deletion.

Synchronisation being off does not mean the extension makes no network connections at all. See Connections Annota makes.

On your device

Each saved item, prompt template and draft is encrypted with its own data key using AES-256-GCM. Those per-record keys are themselves wrapped by a content master key. Only the resulting ciphertext and the wrapped key are written to the local database.

The unwrapped content master key is held in the browser’s memory-backed session storage for the extension’s own trusted pages, and is restricted so that scripts running inside a web page cannot read it. It is not written to persistent local storage.

For cloud synchronisation

Synchronisation currently uses a second, separate mechanism: a recovery phrase generated on your device, from which the key that encrypts the upload payload is derived. That recovery phrase is stored on your device in ordinary extension storage, so that synchronisation can run without prompting you each time.

What is deliberately not claimed

These two mechanisms are not yet one reconciled design, and the project treats that as an open item rather than a finished one. An independent security review is a condition this project has set for itself before publishing any stronger architectural description of its security, and that review has not taken place.

Until it has, this policy describes the mechanism and stops there. It makes no claim that the service is incapable of reading your content, and you should not read one into it.

Some connections happen whether or not you are signed in and whether or not synchronisation is enabled:

• Version and compatibility check. When the extension starts on a ChatGPT page it asks the Annota service whether this extension version is still supported. The request carries the extension version. Like any web request it also reveals your IP address to the service.
• Interface configuration. On installation and on browser startup the extension fetches a configuration file describing how to locate elements in the ChatGPT interface. It is fetched from raw.githubusercontent.com, so GitHub receives that request and your IP address. The file contains no information about you; it is how the extension keeps working when ChatGPT changes its page structure.

Other connections happen only because of something you did:

• Signing in — to Google and Firebase, and then to the Annota service to establish your session.
• Synchronising — to the Annota service, as described above.

The extension requests these browser permissions:

• storage — to keep your saved items, templates and settings on your device.
• tabs — to find and manage your ChatGPT tabs: to track which conversation is generating a reply, and to bring the right tab to the front when you act on a notification. This permission is broader in principle than that use: it lets an extension see tab information such as page URLs. Annota uses it for the ChatGPT tab behaviour described here.
• notifications — to tell you when a long ChatGPT response has finished while you were in another tab.
• declarativeNetRequest and declarativeNetRequestWithHostAccess — to attach the authorisation header to the extension’s own connection to the Annota service. These rules are declared to the browser rather than executed by Annota, and they apply to Annota’s own requests.

Its access to websites is limited to:

• https://chatgpt.com/* and https://chat.openai.com/* — where the product runs;
• the Annota service — for account, version and synchronisation;
• https://raw.githubusercontent.com/* — for the interface configuration file.

The extension does not request access to all websites. It also declares which Annota-controlled pages are allowed to send messages to it, which is how the sign-in page returns the result of your sign-in.

• To provide the product you asked for: capturing passages, keeping them with their source, and letting you search, organise and reuse them.
• To return you to the original message a saved item came from.
• To notify you about the state of a ChatGPT conversation.
• To give you an account, keep you signed in, and associate your data with you.
• To synchronise your workspace between your devices, when you have turned that on.
• To keep the extension working as ChatGPT changes, and to tell you when a version is no longer supported.
• To keep the service secure and to prevent abuse.

Stated as facts about the software as it exists, not as promises about the future:

• There is no advertising technology in the extension, the service or this website.
• There is no analytics, product-telemetry or error-reporting service integrated in any of them. The extension’s diagnostics setting is off by default and its other setting keeps diagnostics on your device.
• Annota does not send your saved content to any external AI or model provider. Annota operates on ChatGPT; it does not have a model integration of its own.
• Your content is not sold or shared with data brokers.

Annota uses these third parties. Each is listed with what it actually receives.

• Google (Firebase Authentication and Firebase Hosting) — hosts the sign-in page and performs the Google sign-in. It handles your Google authentication and the basic profile information the sign-in returns: your Firebase user identifier, email address, display name and avatar URL. Google’s libraries are loaded from Google-hosted infrastructure when that page opens.
• GitHub — serves the interface-configuration file the extension fetches. It receives the request and your IP address, and no information about your account or your saved content.
• The Annota service — the backend that holds your account record and, when you enable it, your encrypted workspace payload. It stores its data in a PostgreSQL database.
• The hosting provider for this website — serves these pages and, like any web host, processes the request and the IP address it came from.

There is no payment provider, because nothing is sold. There is no advertising network, analytics provider or external model provider.

This website sets no cookies, runs no analytics, embeds no third-party content, and loads no third-party fonts or scripts at page load. Its fonts are served from this site.

It stores exactly one value in your browser: a key named annota-theme, written only when you use the light/dark control, so the site remembers the appearance you chose. It contains only that choice, it is readable only by this site, and it is never sent anywhere. Clearing your browser’s site data removes it.

Because the only thing stored is a preference you set deliberately and nothing here tracks you, this site does not ask for consent to store it — this section is the information that goes with it.

What is true of the software today:

• What is stored on your device stays there until you delete it, clear the browser’s data for the extension, or remove the extension.
• An uploaded workspace payload is replaced by the next upload, and otherwise stays on the service.
• Your account record stays on the service for as long as the account exists.

Saved content is encrypted before it is written to local storage, and the workspace payload is encrypted before it is uploaded. Connections to the Annota service use HTTPS, and reaching anything belonging to your account requires a session established by signing in. The version and compatibility check described above is the exception: it carries no account data and needs no session.

No security measure removes all risk, and this project does not claim that its design has been independently verified, because it has not been. Anyone who can use your computer and your browser profile can use your Annota data, so treat device security as part of this.

The extension’s settings include export controls. You can export your saved items as Markdown, and export a structured JSON backup of your saved items, prompt templates and settings. A matching import restores a backup.

These run on your device and produce a file you keep. They do not require a request to anyone.

These are different operations with different effects, and this section separates them rather than implying one command removes everything.

• Deleting a saved item removes that item from your device. If synchronisation is on, the change is carried to your synchronised copy on the next upload.
• “Clear All Local Data” in the extension’s settings removes your saved items, prompt templates and encrypted records from your device. It does not currently remove the chat folders and chat-to-folder mappings described above, and it does not remove your settings, your session or your sync recovery phrase. This is a known limitation of the current implementation, stated here rather than rounded up into “everything is deleted”.
• Resetting the sync key removes the recovery phrase from your device and switches you back to local-only storage. It does not delete the copy already uploaded.
• Turning synchronisation off stops further uploads. It deletes nothing.
• Removing the extension removes the extension and the data your browser holds for it. It does not affect anything already uploaded or your account record.

Annota’s use of information received from Google APIs, and of user data generally, follows the Chrome Web Store User Data Policy, including its Limited Use requirements: information is used to provide and improve the features described in this policy, it is not sold, it is not transferred to advertising platforms or data brokers, it is not used for personalised advertising or creditworthiness, and it is not read by people except where you ask for support, where security or the law requires it, or where it has been aggregated and made anonymous.

If the extension is published, the privacy disclosures in its store listing must say the same things this page says. Where the two ever differ, that is a defect to be fixed, not a choice between them.

When Annota changes what it does with information, this page is updated before or when the change takes effect, and the effective date at the top changes with it. A change that materially widens how your information is used will be brought to your attention rather than left for you to notice.