Privacy Policy

Overview

NoteTaker ("we", "our", or "us") is a Chrome browser extension that lets you capture highlights and annotations on any webpage. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

Using the extension without signing in does not require you to provide any personal information. The optional account features described below are only activated when you choose to create an account and sign in.

Important: This extension does not collect, transmit, or sell any user data for advertising, analytics, or marketing purposes. We only collect the minimal data necessary to provide the core functionality of the extension.

Permissions Used

NoteTaker requests the following Chrome permissions and uses them strictly as described:

• activeTab — used to inject the note-taking panel into the currently active tab when you click the extension icon. We only access the tab you are actively viewing.
• scripting — used to inject the extension's UI script into a page when the content script is not already running. No scripts are injected without a direct user action.
• storage — used to save your notes, highlights, and authentication state locally on your device via chrome.storage.local. This data never leaves your device unless you are signed in and sync is enabled.
• tabs — used to manage the OAuth sign-in flow (opening and closing the Google sign-in tab) and to clean up per-tab state when a tab is closed or navigated away. We do not read your tab history or URLs beyond what is needed for these specific actions.

Information We Collect

Without an account (guest mode): No personal information is collected. All notes and highlights are stored locally on your device only.

With a signed-in account: We collect the following information:

• Email address — provided during account registration (including via Google OAuth) and used solely to identify your account.
• Highlights — selected text you choose to save from webpages.
• Annotations — notes and comments you attach to highlights.
• Page URLs — the web addresses of pages where you create highlights or annotations, used to associate your notes with the correct page.
• Authentication tokens — access tokens issued after sign-in, stored locally in chrome.storage.local to keep you signed in across sessions. These are never exposed to web pages.

We do not collect browsing history, keystrokes, passwords, payment information, precise location, or any data beyond what is listed above.

How We Use Your Information

The information we collect is used solely to provide and improve the NoteTaker service:

• Note sync across devices — your highlights and annotations are stored on our servers so you can access them from any device where you are signed in.
• Note sharing — when you choose to share a page's notes with another registered user, we use the recipient's email address to deliver the share invitation.
• Account management — your email address is used to authenticate you, send account-related communications (such as password resets), and manage your account.
• Offline sync — notes created while offline are queued locally and synced to our servers automatically when you reconnect to the internet.

We do not use your data for advertising, profiling, tracking, or any purpose not listed above.

We do not sell or transfer your personal data to third parties.

Data Storage and Location

Your data is stored in two places:

• NoteTaker servers — when you are signed in, your highlights, annotations, and account information are stored on our backend servers. These servers are operated by NoteTaker and are not shared with third parties. Server data is stored securely and transmitted over HTTPS.
• Your device (chrome.storage.local) — the extension stores a local copy of your notes and your authentication tokens in Chrome's isolated extension storage on your device. This storage is not accessible to websites or other extensions. Guest mode notes are stored only locally and never transmitted to our servers.

Data location: Our servers may be located in various regions. By using NoteTaker with an account, you consent to the transfer and storage of your data in these locations.

Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to third parties. We do not share your data with advertisers or data brokers.

Google OAuth: If you choose to sign in with Google, you will be redirected to Google's sign-in page. We only receive your email address from Google after successful authentication. We do not receive or store your Google password. Google's use of your data is governed by Google's Privacy Policy.

We may disclose information if required by law or to protect the rights and safety of our users, but we will not do so beyond what is legally required.

Data Retention and Account Deletion

We retain your data for as long as your account is active. If you would like to delete your account and all associated data — including your highlights, annotations, and email address — please contact our support team. We will process your request and permanently delete your data within 30 days.

To request account deletion, email us at: support@notetaker.app

Local data: To remove locally stored data (notes, tokens) from your device, you can uninstall the extension or clear the extension's storage via Chrome's developer tools. Uninstalling the extension removes all locally stored data immediately.

Your Rights

You have the following rights regarding your personal data:

• Access — you can request a copy of the personal data we hold about you.
• Correction — you can request that we correct inaccurate data.
• Deletion — you can request that we delete your account and all associated data.
• Portability — you can request an export of your notes and highlights.
• Opt-out — you can use the extension in guest mode at any time without providing any personal data.

To exercise any of these rights, contact us at support@notetaker.app.

Security

Authentication tokens are stored exclusively in chrome.storage.local, which is isolated from web page JavaScript. We use HTTPS for all communication between the extension and our servers. We do not log or expose token values.

The extension uses Manifest V3, Chrome's latest and most secure extension platform, which enforces strict content security policies and limits background script capabilities to a service worker model.

While we take reasonable measures to protect your data, no system is 100% secure. We encourage you to use a strong, unique password for your account and to sign out on shared devices.

Children's Privacy

NoteTaker is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For significant changes, we will notify signed-in users via email. Continued use of the extension after changes are posted constitutes your acceptance of the updated policy.

Contact & Support

If you have any questions about this Privacy Policy or how your data is handled, please reach out: