Privacy Policy

Last updated: 7 July 2026

Pinback is built to keep your data on your own machine. The extension and the pinback-mcp server have no backend: there are no Pinback servers, no accounts, and no analytics.

What the extension handles

• Comments you write, together with the page URL, the element's CSS selector, and a minimal excerpt of the element's HTML (tag and attribute names only — attribute values are stripped so tokens or personal data in the page can't leak into a comment).
• A pairing token you paste in, stored in the browser's chrome.storage.local.

Where that data goes

Comments are sent to exactly one place: a collector run by the pinback-mcp server on your own computer, listening only on 127.0.0.1 (localhost). They are stored in ~/.claudback/comments.json. Nothing is transmitted to the developer or to any third party. Your agent reads the comments locally through MCP tools when you ask it to.

What we collect

Nothing. No telemetry, no analytics, no crash reporting, no remote logging.

Permissions

• storage — keeps the pairing token and buffers unsent comments locally.
• activeTab and scripting — inject the comment overlay, only on tabs you explicitly enable.
• alarms — periodically retries syncing buffered comments to the local collector.
• Per-site host permissions — requested individually when you enable Pinback on a site; never granted broadly.

Deleting your data

Clear comments from the extension's list panel or via the clear_comments tool, or delete the ~/.claudback/ directory. Uninstalling the extension removes the token and any locally buffered comments.

Contact

Questions or concerns: open an issue at github.com/andybiggs/pinback.