This policy covers the hosted service at pinlet.dev, the pinlet browser extension, and this website. pinlet is the operator. Questions and requests go to support@pinlet.dev.
If you run pinlet on your own servers, this policy does not apply to your instance. Nothing from a self hosted instance is sent to us.
What we collect
- Account. Your email address, your name if you give one, and your password hash if you use a password. If you sign in with Google or GitHub, we receive your email, name and avatar from them.
- Workspace. Workspace and project names, the site addresses you add, who is a member, and invitations.
- Comments. The text of every thread and reply, who wrote it, when, and its status.
- Element fingerprint. When you comment on an element, the extension records how to find it again: its tag, attributes, nearby text, its position in the page structure, and a short, truncated piece of its markup with form values removed. Plus the page address.
- Screenshot crops. Depending on the project setting (full page, element only, or off), a screenshot taken when the comment is posted. The default is element only.
- Technical details, only when you ask. If you tick Attach technical details on a comment, the last two minutes of console messages and request summaries from that tab: method, address without query string, status, timing and size. Never request or response bodies, never headers, never cookies.
- API keys. Stored as hashes. We cannot read them back.
- Billing. Your plan and subscription status. Card details go to Polar and never reach us.
- Logs. Our hosting provider keeps short lived request logs (address, time, status, IP address) for security and debugging.
What we do not collect
- The extension does nothing on sites that are not part of one of your projects. It does not record your browsing.
- No analytics, tracking or third party scripts in the extension or the dashboard.
- This website uses Cloudflare Web Analytics, which counts page views without cookies and without identifying you.
- We do not sell data, and we do not use your content to train models.
Why we use it
To run the service: show threads to the people in your workspace, send the emails you expect (sign in links, invites), answer agents that you gave a key to, bill for the Team plan, and keep the service secure. That is the legal basis: performing the contract with you, and our legitimate interest in keeping the service working and safe.
Who processes it
| SUBPROCESSOR | FOR |
|---|---|
| Cloudflare | Hosting, screenshot and attachment storage, website analytics. |
| Neon | The Postgres database. |
| Resend | Transactional email: sign in links, invites, notices. |
| Polar | Payments, as merchant of record. Receipts and tax. |
If you turn on Slack notifications for a project, new threads and replies are posted to the Slack webhook you configured. That is your Slack workspace, under your agreement with Slack.
Who sees your content
The members of your workspace, and any coding agent holding an API key for the project. On a project marked public, like the one on this website, any signed in pinlet user who visits the page can read and add threads.
How long we keep it
As long as your account or workspace exists. On the Free plan, threads older than 90 days are hidden, not deleted. When you delete a thread, a project or your account, the data is removed from the live database right away and from backups within 30 days.
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it. Write to support@pinlet.dev from the address on your account and we will answer within 30 days. You can also complain to the data protection authority where you live.
Comments you wrote in someone else's workspace belong to that workspace too. If you leave, your comments stay with them unless you ask us to remove or anonymize them.
Security
Traffic is encrypted in transit. Screenshots are stored under a workspace prefix and served through short lived signed links. API keys and passwords are hashed.
Changes
If this policy changes in a way that matters, we will say so by email before it takes effect. The date at the top shows the latest version.