Web Markups is a new platform. Keep your own copies of important files. Cloud storage is a convenience feature, not an archival or backup service, and no storage system can guarantee against loss.
Local extension data
The Web Markups extension does not inspect, extract, collect, or transmit webpage HTML, text, form values, cookies, browsing history, or network activity. Drawings, page restoration keys, launcher placement, and preferences stay in Chrome extension storage. The current page URL is used locally to derive an opaque restoration key with a secret unique to your installation. Older URL-based entries are converted when you revisit a page; unvisited legacy entries remain on your device. We do not upload the source URL, hostname, page title, or page-derived hash as separate capture metadata.
Screenshots and recordings capture visible pixels only after an explicit user action. Those pixels may include page addresses, text, or personal information visible in the selected area. Local captures stay on your device. Recordings do not include microphone, system, desktop, or tab audio. The extension contains no advertising or analytics. Website usability measurement is described separately below.
When you click Copy image, the extension writes the captured screenshot to your clipboard as a PNG image. It does not read existing clipboard contents or upload the image as part of copying. Pasting it into another app or website shares it with that destination.
Accounts and information we process
Creating an account provides your email address and a protected password representation. We also process email-verification and login challenges, session and security records, account status, storage usage, subscription status, and the date and version of the Terms and Privacy Policy accepted during account creation. We do not store your plaintext password or complete payment-card details.
If you contact support or use billing, we process the information you submit and the information needed to answer the request, manage the subscription, and protect the service. To operate and protect the service, Web Markups and its hosting providers process request information such as IP addresses, timestamps, and response status. Authentication and abuse-prevention controls also use hashed network identifiers and limited request counters. These essential operations are separate from optional website analytics; rejecting Analytics does not disable account security or service delivery.
Email preferences
We do not currently conduct business outreach or obtain contacts from third-party business-contact providers.
When you use our email-preference service, we store your email address, its source, your email choices, and records of preference changes to manage optional emails and honor unsubscribe requests.
If you receive optional marketing emails from Web Markups, you can change your preferences or unsubscribe through the link in the email, or contact support. These choices do not affect essential account, billing, security, support, or service messages. We retain a minimal unsubscribe record for as long as needed to honor your request.
Optional uninstall feedback
Chrome may open our feedback page when you remove the extension. Opening it does not submit feedback or attach an account, installation ID, or browsing history. If you choose Send feedback, we store your selected reason, any comment you enter, and an optional email address for a reply in our support system to understand problems and improve the product. The form does not send account cookies. Do not include sensitive information. You may skip the form or close the tab. For correction or deletion requests, contact support; the retention and rights provisions below apply.
Optional cloud media
Cloud upload is available only when a verified Free or Pro account holder explicitly chooses Save to Cloud for a capture. This choice applies to that capture and does not enable background uploads or annotation synchronization. We store the media, a random media ID, your user ID, filename, type, size, and creation time. We do not attach the source URL, hostname, page title, or a page-derived hash as separate metadata. Uploaded captures still contain whatever is visible in the image or video.
Optional sharing links
Cloud files are private until you explicitly create a sharing link. When sharing is available, you choose an expiration and whether a separate password is required. Anyone with the link, and its password when enabled, can view and download that file without signing in. Links can be forwarded. We store the sharing settings, expiration, password hash when used, and security records of link creation, changes, and revocation. We use limited request counters and hashed network identifiers to prevent abuse; we do not display a list of recipients or track shared-file views with advertising or website analytics.
You can stop sharing, replace a link, or delete the file. Expired, revoked, or replaced links stop granting new access. Copies that recipients already opened or downloaded cannot be recalled. Sharing pages do not use account cookies or third-party analytics, and shared files are not intentionally indexed by search engines. Expired link settings remain available for you to manage until you remove the link or file. Share only material you have permission to disclose.
How information is used and shared
We use information to operate accounts, authentication, billing, cloud storage, support, security, abuse prevention, email preferences, and public website usability measurement. We do not sell personal information or extension data and do not use it for personalized advertising.
Our service providers include Cloudflare for website and API hosting, security, databases, and private media storage; Amazon Web Services SES for account and service email; and Stripe for checkout, subscription billing, and payment processing. Optional public-page measurement uses Google Analytics and Microsoft Clarity as described below. Each provider receives information needed for its role; using one service does not automatically enable optional analytics. Information may also be disclosed when required by law, to protect users or the service, or as part of a business transfer subject to applicable notice and safeguards.
Website analytics and privacy choices
The Analytics preference controls optional usage analytics from Google Analytics and Microsoft Clarity session recording together. Select Accept all, or check Analytics in Manage preferences and select Confirm, to enable them. Uncheck Analytics and confirm to disable both. Cancel leaves your saved choice unchanged. On a first visit, Analytics is preselected in the panel as an unsaved choice; this alone does not enable tracking. Saved rejections and browser privacy signals keep it unchecked. Preferences remain available through the fixed Manage preferences button, and the notice and preferences panel do not block use of the page.
On a first visit, optional tracking may start only where an explicitly configured regional policy permits it. No regions are currently configured for automatic tracking. Unknown regions, unavailable regional checks, and unavailable preference storage default to off. Regional decisions use Cloudflare’s country and region information, not browser language or visitor-supplied location headers. Our preference endpoint returns only whether an automatic policy applies; it does not store your location or create an account profile. An automatic default is not recorded as your acceptance.
Essential browser storage remembers your explicit choice, its version, and date in wm-privacy-v1 for a seven-day validity period. After seven days we ask again; the stored record can remain until replaced or cleared. A separate wm-privacy-rejected marker remembers a rejection without a unique identifier. It is stored in local storage without automatic expiry and backed up by a host-only cookie with a maximum lifetime of 400 days. The local marker can restore that cookie. After rejection, tracking remains off even when the seven-day choice or the backup cookie expires, until you explicitly accept. Clearing all site storage can remove both markers. Earlier partial opt-outs remain respected. These preferences apply to this browser and website, not every device or your account.
We use Google Analytics to measure visits and selected product-link clicks, and Microsoft Clarity to understand how visitors interact with approved public pages. We use these insights to improve our products and web pages. Clarity can collect clicks, scrolling, mouse movements, page layout and changes, window sizes, and related interaction and performance events. It produces heatmaps and session replays that reconstruct website interactions; these are not videos of your screen. These services may also process page information, browser and device information, IP addresses, cookie identifiers, and related request information. We do not enable advertising storage, Google signals, or personalized advertising.
Typing and sensitive content: Clarity can detect input interaction events, but Microsoft states that input-box and dropdown contents are masked before transmission. We do not use Clarity as a keystroke logger or to collect the text you enter into forms. Our website excludes pages containing forms, editable fields, embedded frames, and marked private or user content outside the privacy controls, including the homepage email form and drawing demo. If a sensitive surface appears dynamically, tracking is stopped and the document reloads to unload the providers; a session-only list keeps that page excluded for the tab. We additionally mask page content for Clarity. Public pages containing sensitive content must not be made eligible for recording. Form, chat, payment, health, password, and annotation content must not be sent to website measurement providers. See Microsoft's data collection documentation and masking documentation for details.
Neither provider loads without explicit acceptance or an enabled first-visit regional policy. Rejection and supported Global Privacy Control or Do Not Track signals override automatic policies. Browser privacy signals also set the rejection marker. Saved changes synchronize across open tabs. Account, authentication, billing, support, shared-file, email-preference, onboarding, uninstall, and unknown pages remain excluded. The extension itself contains no analytics or advertising. Our essential hosting and security logs continue regardless of this preference.
Withdrawal stops our events, clears known first-party measurement cookies, and reloads the page to unload providers already running. It does not erase information previously sent or cookies held on a provider's own domain. The seven-day preference period is not a retention period for collected analytics. Microsoft publishes separate retention periods for Clarity recordings and heatmaps in its data-retention documentation. Google Analytics retention depends on the property’s settings. We have not verified the current provider-dashboard retention settings; we do not claim that withdrawing permission erases historical data. Already transmitted or in-flight data cannot be recalled by the preference controls. Contact support with privacy questions or deletion requests.
Retention, access, and deletion
Local annotations and settings remain in Chrome extension storage until they are cleared. Resetting the extension clears the current page’s annotations and resets preferences; it does not erase saved annotations for other pages. Removing the extension or clearing its storage removes its local data. Downloaded files remain where you save them. Cloud media is stored until you delete it or we process a deletion request, subject to temporary backups, security records, legal requirements, and technical recovery periods. Account closure and deletion requests are handled through support; closing a browser tab or disconnecting the extension does not delete your cloud files. Billing records may be retained as required for accounting, fraud prevention, disputes, and law. A minimal unsubscribe record may be retained after an unsubscribe so the request continues to be honored.
The launch waitlist is no longer used for signup. Any remaining launch-waitlist records remain subject to the original deletion deadline: when you leave or no later than 90 days after public launch, unless law requires longer retention.
You may review and delete individual cloud captures from your dashboard. For account, email-preference, access, correction, or deletion requests, use the official support form. We may verify your identity before acting. Some records may be retained when legally required or needed to protect the service.
Security, data loss, and sensitive information
We use access controls, private storage, encrypted transport, and server-side ownership checks. No system is completely secure or continuously available. Keep independent copies of anything important and review every capture before uploading.
Do not upload sensitive, confidential, or regulated information. Prohibited content includes payment-card or bank data, financial or tax records, health or medical information, biometrics, government identifiers, passwords, authentication tokens, private keys, children's personal data, trade secrets, and other information requiring specialized compliance or security. If you upload it accidentally, delete it and contact support.
Chrome policy and site access
Information received through Chrome APIs is used only for the user-facing annotation and capture features. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Chrome lets you change site access through Manage extension → Site access.
Children, transfers, and policy updates
Web Markups is not directed to children, and users must meet the age requirements in the Terms. Information may be processed in locations where Web Markups and its service providers operate.
We review and may update this policy periodically as the service changes. Check this page for the current version and last-updated date. Material changes will receive additional notice or renewed acceptance when required by law or appropriate for the change.
Contact
Submit privacy questions or requests through the official support form.