Notepix Privacy Policy

Effective date: 27 August 2026

Notepix lets you pin notes, frames and freehand marks onto a web page and copy them as a brief for an AI coding agent. The short version: your pages, notes and screenshots never leave your machine. The only traffic that leaves your computer is the license check.

What stays on your device (everything you create)

• Annotations — your notes, frames, drawings, element references and the source-file information Notepix resolves for them are stored in Chrome's local extension storage on your computer, keyed per page. They are never transmitted anywhere. "Copy for AI" puts them on your clipboard; where you paste them is up to you.
• Screenshots — captured only when you click a screenshot button, using Chrome's capture API for the tab you are annotating. They are cropped and processed entirely on your device and end up on your clipboard (or in a file you save). They are never uploaded.
• Settings — your copy-format choice and panel position are stored in Chrome's local extension storage, alongside the install date (for the 7-day trial countdown), the local-agent connection setting described below and — after a purchase — your Gumroad license key.
• Page content — Notepix reads the page you annotate (element positions, styles, and — on development builds — React source metadata) solely to build your annotations, locally. It does not log, index or transmit page content.

Uninstalling the extension deletes all of the above from your device.

Optional: letting a coding agent on your computer read your marks

Notepix can hand your annotations to an AI coding assistant running on the same computer, so you don't have to copy and paste them. This is off until you switch it on in the extension's "Connect to my coding agent" page.

When it is on, the extension opens a connection to 127.0.0.1 — the loopback address of your own machine — where a small companion program you installed yourself (npx notepix-mcp, open source, MIT) is listening. Your annotations, and any screenshots you attached to them, are passed to that program so your coding assistant can read them; your assistant can also mark an annotation as done, which is the only change it can make.

This traffic never leaves your computer: loopback addresses are not routable, there is no Notepix server anywhere, and the companion program only runs while you run it. It is also the only thing the connection can reach — the companion refuses any connection that does not come from this extension. What your coding assistant then does with the annotations is governed by whoever makes that assistant.

Switching the feature off closes the connection immediately; with it off, Notepix makes no local connections at all.

The one call to the internet: license key verification (Gumroad)

Notepix is free for 7 days, then asks for a one-time unlock. The purchase happens on a Gumroad (gumroad.com) product page that opens in a normal browser tab — like any online purchase, it is governed by Gumroad's own terms, and your payment details and email go to Gumroad, never to the extension. Gumroad then emails you a license key.

The extension itself makes no network requests at all until you paste that license key into the panel. From then on, the extension verifies the key against Gumroad's license API (api.gumroad.com) — once at activation and at most weekly afterwards. That request carries only the product id and the license key — nothing about your pages, annotations or browsing. See the Gumroad privacy policy for how Gumroad handles purchase data. The license key is stored in Chrome's local extension storage on your device; entering the same key on another machine restores your purchase there.

What Notepix does NOT do

• No analytics, telemetry, tracking or ads.
• No collection of browsing history, page content, keystrokes or personal data.
• No selling or sharing of any data with anyone, for any purpose.
• No remote code: all code ships inside the extension package.

Permissions, briefly

• activeTab + scripting — inject the annotation panel and take a tab screenshot, only on the tab you invoke Notepix on.
• storage — keep your annotations and settings on your device.
• contextMenus — the right-click "New note" shortcut.
• alarms — one periodic reminder used only to re-open the local agent connection above after Chrome suspends the extension. No alarm is scheduled while the feature is off.
• localhost content scripts — on local development servers Notepix loads automatically so annotations survive page reloads. Local only.
• api.gumroad.com host permission — lets the extension verify your license key with Gumroad. Used for nothing else.
• 127.0.0.1 connection — only when you switch on "Connect to my coding agent", and only to your own machine. Needs no host permission because it never leaves the device.

Changes and contact

If this policy changes materially, the new version will be published at the same URL with an updated effective date. Questions: [email protected].