Privacy
pinprompt is a feedback tool your agency runs on its own server. The browser extension lets you pin feedback on a project's staging and preview sites. This page says what the extension and the pinprompt app collect, where it is kept and who can see it.
- The extension is only active on your projects' sites, and only sends page content when you leave feedback there.
- Everything goes to this pinprompt server and nowhere else, unless your agency connected one of the services listed below.
- No analytics, no advertising, no selling or sharing of data. The makers of pinprompt receive nothing.
- Feedback, its evidence and whole projects can be deleted, and evidence can be set to expire.
What the extension does on web pages
The extension runs only on your projects' sites (staging, previews and production) and on this pinprompt server, where it picks up your sign-in. On every other page it runs no code at all. To know where to run, it compares the addresses of the pages you open with your projects' site addresses inside your browser. The addresses of other pages are not sent anywhere and not stored.
On a project site, and only there, the extension:
- asks this server for the feedback already pinned on that page, sending the page address;
- keeps a short log of the page's own network requests and console errors in the page's memory: at most the last two minutes, never request or response bodies, headers or cookies. It is thrown away when you leave the page and only sent if you leave feedback with the network log switched on.
It does nothing on pages that aren't a project site, and nothing at all while you are signed out.
What is collected when you leave feedback
Only when you file feedback, the extension sends this server:
| What | Details | When |
|---|---|---|
| Your noteevery report | What you typed, and your answers to follow-up questions. | every report |
| Pageevery report | The page address and title, the window size and pixel density, and your browser's user agent. | every report |
| Elementwhen you pick one | Its CSS selector and tag, up to 500 characters of its text, its HTML trimmed to 4,000 characters with form values masked and scripts removed, its position, a few computed styles, and the source file or component name if the site exposes them. | when you pick one |
| Screenshotevery report | The element and the part of the visible page around it, outlined. Password, card and one-time-code fields, and anything marked data-private or data-pinprompt-private, are blacked out before the image is taken. | every report |
| Network and console logswitch, on by default | The page's requests (method, address, status, timing, size) and console errors from the last two minutes. Bodies, headers and cookies are never read. Tokens, emails, ids that look secret and personal-data parameters are removed in your browser before sending, and again on the server. Clients get the switch off by default. Project owners can turn it off for a project. | switch, on by default |
| Talkwhen you use it | A voice note from your microphone and its transcript, plus the elements you pointed at. The live transcript uses your browser's speech recognition: Chrome sends the audio to Google and Edge to Microsoft to turn it into text. If you type instead, no audio is involved. | when you use it |
| Recordwhen you use it | Up to 60 seconds of video of the current tab (no tab audio) with a transcript of what you say, and the elements you clicked. Chrome asks you to choose what to share first. The transcript comes from your browser's speech recognition, as with Talk. | when you use it |
Form values are masked in the element's HTML and emails, tokens and card numbers are removed from text, but anything visible on screen can appear in a screenshot or recording. Don't leave feedback over personal data you aren't allowed to share with your team.
What the app keeps about you
- Your name, email address, the projects you belong to and your role in each.
- Sign-in sessions and the personal token the extension uses. Both are stored only as one-way hashes.
- What you do in pinprompt: feedback, comments, votes, sign-offs and status changes, each with a time and your name.
- Emails sent to you (sign-in links and notifications). Sent mail is deleted after 30 days (mail that couldn't be delivered after 90), sign-in emails after one day.
Where it is stored
Everything above is stored on this pinprompt server: a database and a folder of evidence files (screenshots, recordings, transcripts and network logs). The server is run by your agency. Traffic between the extension and the server is encrypted (https).
The extension itself keeps, in your browser profile:
- your personal token, this server's address and a copy of your name, email and project list (until you sign out or remove the extension);
- the open-feedback counts and review position for your open tabs (until you close the browser).
Who can see it
- Members of a project see that project's feedback and evidence, according to their role.
- Clients see only their own feedback and the team's replies to it, without selectors, file names, transcripts or network logs.
- Coding agents your team connects to a project (over MCP, with a token) can read that project's feedback and evidence to fix it.
Services your agency may connect
These only receive data if your agency turned them on, and only for the projects they are connected to:
- Anthropic (Claude) drafts the feedback spec from your note, the page and element details, the transcript, the network summary and console errors. On this server Claude drafting is on, and screenshots are not sent with it.
- GitHub, Sanity, Slack and webhooks receive the feedback and status changes they are set up for in Settings → Integrations.
- An email provider delivers sign-in links and notifications.
Data received from the extension is used only to provide pinprompt's feedback features. Its use adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. It is never sold, never used for advertising or credit decisions, and never read by people except to provide the service, for security, or when the law requires it.
How long it is kept, and deleting it
Feedback and its evidence stay until they are deleted, or until the evidence retention below removes the evidence.
- Evidence retention. On this server evidence is kept until the feedback is deleted. A workspace owner can set it to be removed 30, 90, 180 or 365 days after feedback is closed; the feedback's text and replies always stay.
- Deleting feedback. Project owners and PMs can delete any feedback. You can delete your own for 15 minutes after filing it, while nobody has started on it. Deleting removes the feedback, its replies, every version of its spec, its evidence files and its search entries. The activity log keeps only a line saying that an item with that number was deleted, and connected services (below) are told it was deleted, without its content. What they received before stays with them (a GitHub issue's text, a Slack message) until it is deleted there.
- Deleting a project. Archiving a project hides it and keeps its data. An owner can then delete it: for 7 days it can still be restored, then the project and everything in it, evidence files included, is deleted.
- When you leave. A workspace owner removes you: you are signed out everywhere and your extension token stops working. What you reported and wrote stays, shown as from a former member; it can also be anonymised, which replaces your name with “Former member” and deletes your email address.
- Logs of email and integration deliveries are deleted after 30 days.
- Copies in your agency's backups of this server last as long as those backups do.
Your choices
- Switch off the network log, or don't use Talk or Record, for any piece of feedback.
- Mark page areas that should never be captured with
data-pinprompt-private. - Sign out in the extension's popup to remove the token. Removing the extension deletes everything it stored in your browser.
- Delete your own feedback from its page within 15 minutes of filing it.
- Ask a project owner for a copy of a project's data (they can download it as a zip), to delete feedback, or to remove and anonymise you.
Contact
Questions about this server and the data on it go to the agency that runs it, through your workspace owner. We will update this page and its date when what pinprompt collects changes.