Privacy policy — Replayink

The short version: almost everything the extension does happens entirely on your computer and is never transmitted anywhere. There is exactly one feature that sends anything off your machine, it is never automatic, and this policy is mostly about being precise about that feature.

1What stays on your computer#

All of the following work with no network connection and send nothing to us or to anyone else:

Drawing on a page — pen, highlighter, shapes, arrows, text labels, sticky notes, comment threads
Everything you type into a note, a comment or a category name
Marking up PDFs in the extension's built-in viewer, including PDFs on your own disk
Your settings, keyboard shortcuts, colour categories and per-site rules
Presenter mode (laser pointer, spotlight, ink)
Taking a screenshot with your annotations drawn on it
Recording an interactive demo — the screenshots, the page copies and everything captured with them are written to your browser's local storage and go nowhere else
Copying a share link (…#ap=…) — your annotations are compressed into the link itself, so the link is the transport; nothing is uploaded to make one
Exporting a recording as JSON or as Markdown

This data lives in your browser's own storage (chrome.storage.local and chrome.storage.session). Your annotations — and only your annotations, not recordings — are also written to chrome.storage.sync, which is Chrome's own profile sync. That means they travel between your own signed-in Chrome installations through Google's sync service, not through us. We never see them. You can turn this off in the extension's settings.

We do not collect analytics about your use of the extension. There is no telemetry, no crash reporting, no usage counter, no advertising or tracking SDK of any kind in this extension. We do not know that you installed it, how often you open it, or which pages you visit.

2The extension can see every page you visit. It does not send them anywhere.#

Replayink requests access to all websites, because you can ask it to draw on any page and it cannot know in advance which pages those will be. Access to a page is not the same as collecting it. Your annotations are stored locally against the address of the page you made them on, and page content is read only to place your marks back where you put them.

You can switch the extension off completely for individual sites, in Settings → Sites & URLs or with the per-site toggle in the extension's popup.

3The one thing that is uploaded: publishing a recording#

The Share link and Publish buttons in the recording player upload a recording so that it becomes a web page anyone with the link can open. This only ever happens when you click one of those buttons. Nothing about a recording is uploaded before then, and deleting a recording you never published means it was never anywhere but your own computer.

When you publish, these are uploaded and stored:

The screenshot taken at each step
The saved copy of each recorded page — its HTML, its form contents at that moment, and the stylesheets, images and fonts it referenced
The web addresses of the pages in the recording, and the recording's title and step notes
The account identifier described in section 5

3a. Please read this before publishing a recording of a site you are logged in to#

To make the saved copy of a page look the way it did when you recorded it, the extension fetches that page's stylesheets, images and fonts using your browser's cookies for that site — the same way the page itself loaded them.

The consequence is that a recording made inside a logged-in account can capture things only you were supposed to see: your name, your data, an image that is private to your account. If you then publish that recording, all of it becomes part of a page that anyone with the link can open. Anyone who has the link can see it; the links are not indexed by search engines, but they are not secret either.

Before you publish, look at what is actually in the recording. If it contains anything you would not put on a public web page, do not publish it. Keep it in your library, or export it as JSON (More… → Download as JSON), which produces a file you keep yourself, with no upload.

Values you type into password fields, credit card fields and one-time-code fields are replaced with dots before they are ever stored, even locally. Settings → Interactive recording → Mask everything typed extends that to every field.

3b. What is deliberately kept out#

Addresses that are not http or https are never uploaded. A recording of a PDF on your own computer is published under the document's file name only — the path to it on your disk (file:///Users/yourname/…) is removed from the page, from the link preview and from the saved copy of the document.

A published recording is served from a page at annotate-share.surajp609.workers.dev. That page counts how it is used so you can see whether your demo worked, and it records, per viewer:

A random identifier stored in that viewer's browser, so repeat visits are not counted twice. It is not linked to any account and identifies nobody.
The referring page, if the browser sent one, truncated to 300 characters
The browser's user-agent string, truncated to 200 characters
Which step they reached, whether they finished, and how long the page was open

There are no advertising cookies and no third-party trackers on these pages. These statistics are readable only by the account that published the recording. If you send someone a link, the page they open will collect the above about their visit.

5Accounts#

The first time you publish, the extension creates an anonymous account for that browser. It has no name, no email address and nothing you typed — it exists so your published recordings belong to you and so only you can read their statistics. The access token for it is stored in your browser.

You can optionally attach an email address (Settings → Cloud account) so that the same published recordings and statistics are available on another computer. If you do, we store that email address, and it is used only to sign you in with a one-time code. We do not send marketing email. There is no password.

6AI features are switched off in this build#

The extension contains an optional feature that can write step notes and record a voiceover using a language model. It is disabled in the version published on the Chrome Web Store: the buttons are not shown, and no text, screenshot or audio is sent to any AI provider by this build. If that changes, this policy will change with it before the feature ships.

7Who else handles this data#

Supabase (supabase.com) — the database and file storage where published recordings live
Cloudflare (cloudflare.com) — serves the published pages and this website

They process this data on our behalf in order to run the service. Beyond them, we do not share, sell, rent or transfer your data to anyone. We do not use it for advertising, for profiling, or for anything unrelated to showing you your own recordings and their statistics. We do not use it to train machine learning models.

We will disclose data if we are legally required to.

8Keeping and deleting your data#

Anything not published is on your computer only. Uninstalling the extension removes it, and so does Settings → Sync & data → Clear. Once it is gone we cannot recover it, because we never had it.
Unpublish in the player removes a published recording and its uploaded files. Its statistics are deleted with it. The link stops working.
Published recordings are kept until you unpublish them or ask us to delete your account.
To delete your account and everything published under it, email the address in section 11. We will action it within 30 days.

You may ask what we hold about you and ask for it to be corrected or deleted, at the same address.

9Children#

Replayink is not directed at children and we do not knowingly collect anything from anyone under 13.

10Changes to this policy#

If this policy changes, the date at the top changes with it. A change that widens what is collected will be announced in the extension's release notes on the Chrome Web Store, not made quietly.

11Contact#

Replayink is made by an individual developer, not a company.

Email: surajp609@gmail.com

Questions, deletion requests and privacy complaints all go to that address.