Privacy Policy

StiqNote is a Chrome extension that lets teams pin comments on web pages and discuss them. This policy says what it collects, why, where it goes and how long it stays.

StiqNote is run by Broes Consulting BV, Stationsstraat 140A, 8340 Sijsele, Belgium, company number 0761.614.207, VAT BE0761614207. Broes Consulting BV is the controller of your account and billing data, and of the other data this policy describes that we need to run StiqNote. For what a team posts about its own websites (comments, screenshots, recordings, console and network logs, replays and clients' approvals), the team's owner decides what is collected and why: the team is the controller, and we process that data on its behalf as its processor, under our data processing agreement. Paying teams accept it with their plan, and a signed copy is available on request.

#What we collect

• Account information: your email address. If you sign in with Google, also your name and profile picture. Used to sign you in and to show teammates who wrote what.
• Comments and what you attach: the text of your comments and replies, the element on the page they're pinned to (its selector and a short description of the element, such as its tag, text and classes), the text you selected when you comment on selected text, and any screenshots, files or recordings you add. Stored so your team can see and answer them.
• The address and title of pages you comment on: used to show each comment on the right page.
• Browser details with each comment: browser, operating system, window size, screen size and zoom, so the team can reproduce what you saw.
• Console and network logs (Pro and Agency): while a page is open, StiqNote keeps its recent console messages and a list of its network requests (method, address, status and timing, never request or response contents or headers) in your browser's memory. They are sent only when you post a new comment on a Pro or Agency team. You can turn this off in Settings → Bug reports. Anything that looks like a credential is replaced with "[redacted]" before it's kept: tokens and keys in web addresses, anything after # in an address, and tokens, passwords and keys in console messages.
• Session replay (Pro and Agency): see the next section.
• Screen recordings (Pro and Agency): up to five minutes of the browser tab you choose to share, plus your microphone if you turn it on. Recording starts only when you press record and approve Chrome's sharing prompt.
• Billing information: for paying teams, the plan, billing period, subscription status and the customer and subscription references Stripe gives us. Your card details and billing address go to Stripe directly; we never see or store card numbers.
• Usage counts for trial emails: during the free Agency trial we count how many replays, logs and recordings a team attached, and whether it used client sign-off or branding, to tell the team's owner what they used and suggest a plan.
• Client sign-off (Agency): when a team starts a review round, we store the round: its site, its pages, whether one client or every client must approve, and any due date and note. We also store which clients were asked and when they were reminded. When a client answers, we store their name, their answer (approved or changes requested), any note they add, and the time. A request for changes also posts the note as a comment on the page. Closed rounds stay as the team's round history.
• Pages from a sitemap (Agency): when a member picks a round's pages from the site's sitemap, StiqNote fetches that site's public sitemap.xml, only at that moment and only because they asked. We keep only the addresses of the pages they pick, not the sitemap.
• Branding (Agency): the logo, brand colour and name a team shows its clients. The logo is served from a public address, so it can show in emails.
• Error reports (only if you agree): when StiqNote's own code hits an error, it asks "Send a report?" first, and sends nothing unless you say yes. You choose in Settings → Privacy: Ask (the default), Always or Never. A report holds the error message, a short technical stack trace, the extension version, your browser and which part of StiqNote it came from, and the site's name (such as example.com), never the page's address, what's on it, or who you are. Errors from the website itself are never sent. Reports are deleted after 30 days.
• Uninstall feedback: when you remove StiqNote, Chrome opens a page on stiqnote.com with one optional question. Its address carries only the extension version and roughly how long it was installed (0, 1–7, 8–30 or 31+ days), never who you are. If you answer, we keep the reason you picked, anything you write, that version and rough age, and your country (from your connection). Your email only if you leave it for a reply.
• Preferences: theme, pin colour, keyboard shortcuts, toolbar position, which sites StiqNote is shown or hidden on, and notification settings. Most are stored only in your browser; notification settings are stored with your account.

#Session replay

On Pro and Agency, StiqNote can attach "the last 3 minutes" of the page to a new bug report, so the team sees what happened before the problem.

• What it records: changes to the page's structure and layout, mouse movement, clicks, scrolling and page navigation, using the open-source rrweb library. It runs only on pages where StiqNote is active and you're signed in to a Pro or Agency team.
• Where it never records: email, banking, social media, chat, video, shopping and payment sites, and any site or page you hide StiqNote on.
• What it never records: what you type. Every form field is masked, and password, card, bank account and ID fields record nothing at all; a page can also mark any element of its own as private so it's recorded as an empty box. The team owner can also turn on "Hide all text in replays", which replaces all page text with placeholders.
• It stays in your browser until you report something. The recorder keeps a rolling buffer of about 3 minutes in memory. Nothing is sent unless you post a new comment with the replay attached; you can remove it from the comment before posting.
• You can limit it or turn it off in Settings → Bug reports: every page, only pages with comments, or off. It records on every page by default for Pro and Agency.
• How long it's kept: 30 days on Pro, 90 days on Agency, then it's deleted automatically.

#What happens on pages you visit

To show comments where they belong, the extension asks our server whether the page you're on has comments. It does this on pages where StiqNote is active while you're signed in. The request contains the page's address with advertising, tracking and credential parameters removed (for example utm_…, gclid, token, code, session). We don't store that address unless you comment on the page, and it's sent in the body of the request so it doesn't appear in our request logs.

StiqNote starts hidden on a built-in list of sites where nobody reviews a website, such as email, chat, social media, video and banking-style apps. You can show it there, or hide it on any site or page, from the toolbar icon.

Nothing else about the pages you visit leaves your browser: no page content, no browsing history, no keystrokes.

#Guest review links

A team can share a review link with people outside it. Guests sign in with a one-time code sent to their email address, see only the sites the team shared with them, and can comment there.

A review link can also open the site through our review proxy (<link>-view.stiqnote.com), so guests can comment without installing the extension. The proxy fetches the shared site's public pages and adds StiqNote to them. It never forwards the guest's cookies or passwords to the site, and turns off password fields. The guest's sign-in is kept in the browser's local storage for that review address.

#What we don't do

• We don't sell data or share it for advertising.
• We don't add ads, analytics or tracking scripts to the pages you visit.
• We don't use your data to train AI models.
• We don't read your comments, except to help with a support request you started or to investigate abuse.

#Who can see your data

• Comments are visible to the team they were posted in, never to other teams.
• Private comments are visible to team members only, not to guests. This applies everywhere, including live updates, notifications and emails.
• Console and network logs and session replays are visible to team members and to the person who posted the comment.
• Your name, email address and picture are visible to the people on your teams.
• Guests see only the sites they were invited to, and never private comments.
• Approvals: the team's members see every client's answers, notes and times, and the round history. A client sees only their own answers, and whether each page is approved.
• Branding: a team's clients see its logo, colour and name on the review page, the guest bar and the emails they get.
• API keys: if you create an API key, tools you give it to can read your team's comments (never private ones), reply to them and change their status, acting as you. You can revoke a key at any time in Settings.
• GitHub: if your team connects GitHub and sends a thread there as an issue, the thread's text, the page address, links to its screenshots, attachments and replay, and the reporter's name go into that issue. Before it's created, StiqNote warns you if the thread is private, the repository is public, or the reporter's email address would be included. Whoever can see the repository can see the issue.
• Slack, Microsoft Teams, Linear, Jira, Asana, ClickUp, Trello and Notion: if your team connects one of them, the same content as for GitHub goes into the issue, task, Slack message or Teams card your team chooses, and status changes sync back. Slack messages include the comment, the page and the author.
• Webhooks: if your team adds a webhook, StiqNote sends the events it picks (new comments, replies, status changes) to the address it gives, signed with its secret. Private comments are never sent.
• Comment sync: if your team turns on comment sync for a connected tool (GitHub, Linear, Jira, Asana, ClickUp, Trello, Notion, monday.com or Basecamp), comments on the linked item in that tool are imported into the thread as private notes, unless your team chooses to show them to everyone in the thread, and StiqNote stores the name of the person who wrote each one. Private notes are visible only to your team's members, never to guests, and are never sent on to other tools, webhooks or automations. These names are deleted with the thread.
• Billing: the team's owner (and the billing contact, after a transfer) can see the team's invoices in Stripe's customer portal.

#Where data is stored

• Accounts, comments, teams, logs, review rounds and billing references are stored in a Cloudflare D1 database in Western Europe.
• Screenshots, files, recordings, replays and logos are stored in Cloudflare R2. Everything but logos is served only through links that expire after 24 hours (links in GitHub issues stay valid while the thread is linked to that issue).
• Live updates use Cloudflare Durable Objects. Nothing is kept there beyond the open connection.

Some of the services below are based outside the European Economic Area, mainly in the United States. Cloudflare, Stripe, Google, GitHub, Microsoft, Salesforce (Slack), Atlassian, Asana and Automattic (Gravatar) are certified under the EU–US Data Privacy Framework, and transfers of data to them in the United States rely on it. Where a transfer isn't covered by the framework, it relies on the European Commission's standard contractual clauses. Brevo is based in France, so email delivery stays in the EU.

#Email

We send sign-in codes, team invites, and, if you turn them on, email summaries of replies, mentions, assignments and due dates, plus a Monday summary of what's due that week. You can change the summary frequency or turn them off in Settings. The owner of a team on a free trial gets two emails: three days before the trial ends, and on the day it ends. Stripe sends receipts and payment notices for paying teams. Emails are delivered by Brevo.

On Agency, clients asked to review a round get an invite, any reminder a member sends, and a receipt when they approve. These emails, and the sign-in code a client asks for from a review link, show the team's name and logo, and come from the team's name followed by "via StiqNote". The team's members get an email when a client approves a page or asks for changes, which they can turn off in Settings.

#Profile pictures and Gravatar

To show teammates' pictures, the extension asks Gravatar for an image matching a SHA-256 hash of their email address, sent without the address of the page you're on. If there's no Gravatar, initials are shown. Gravatar is run by Automattic.

#Browser storage

The extension doesn't use cookies. It keeps your session, current team, preferences, the sites you've hidden or shown, and a short-lived copy of the comments on recently viewed pages (for up to five minutes, the last 30 pages) in Chrome's extension storage on your computer. Signing out removes the session.

#Why we're allowed to process it (legal bases)

• To provide the service you signed up for (contract): your account, comments, attachments, logs, replays, recordings, guest links, review rounds and approvals, branding, email notifications you turned on, and billing.
• Our legitimate interests: keeping StiqNote secure and working (error reports, rate limits, abuse checks), and the trial emails that tell a team's owner their trial is ending.
• Legal obligations: keeping invoices and billing records for as long as tax law requires.
• Consent: your microphone during a recording, and anything else we ask your permission for.

#How long we keep data

• Comments, files, recordings and logs stay until someone deletes them, or the team is deleted.
• Review rounds, clients' answers and notes, and the round history stay while the team exists, and are deleted with the team. A client can undo their answer, and a member can clear one. If a client deletes their account, their answers, notes and times stay in the round's record, shown as "Deleted user" instead of their name and email, so the team keeps its sign-off history.
• A team's logo and brand settings stay until the owner changes or removes them, and are deleted with the team. A replaced logo is kept, so emails already sent still show it.
• Session replays are deleted after 30 days on Pro and 90 days on Agency.
• Your IP address is used only to limit sign-in codes, contact messages and error reports against abuse. It is kept with a counter and deleted within two days.
• If a team moves to a lower plan, nothing is deleted; Pro features become read-only.
• If you delete your account, your account and sessions are deleted immediately. A team you own is deleted with its comments and files when no other member is left in it, even if it still has guests; their comments in it are deleted too. If another member is left, the longest-standing one becomes the owner and the team stays. In teams that stay, your comments, guest links and sign-off answers are kept, shown as "Deleted user". Deleted data can remain in our database provider's recovery copies for up to 30 days.
• Billing records are kept for as long as Belgian tax law requires: 10 years.
• Uninstall answers are kept for two years, then deleted.
• Error reports are deleted after 30 days.
• Sign-in codes expire after 10 minutes. Sessions expire after 30 days without use.

#Your rights

Under the GDPR you can access, correct, export or delete your data, object to or restrict how we use it, and withdraw consent you gave. You can delete your account yourself in Settings. For anything else, email privacy@stiqnote.com. You can also complain to your data protection authority; in Belgium that's the Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be).

#Children

StiqNote is a tool for work and isn't meant for children. You must be at least 16 to use it.

#Chrome permissions

• Access to all sites: StiqNote works on any page you want to review, including staging and localhost sites. It only shows its toolbar and pins, and only sends the page-lookup request described above.
• Storage: keeps your session and preferences in the browser.
• Scripting: runs the small scripts that capture console and network logs and the session replay for Pro and Agency reports inside the page.
• Active tab: takes a screenshot of the tab you're commenting on when you ask for one.
• Identity: runs Google sign-in.
• Notifications: shows desktop alerts for new replies and mentions.
• Side panel: shows StiqNote's comment list, inbox and settings beside the page.

#Chrome Web Store: Limited Use

StiqNote's use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements. We use that information only to provide and improve StiqNote's single purpose, commenting on web pages with your team. We don't transfer it to others except as described in this policy, don't use it for advertising, and don't let people read it except as described above.

#Services we use (sub-processors)

Privacy policies: Cloudflare, Stripe, Brevo, Google, GitHub, Slack, Microsoft, Linear, Atlassian, Asana, ClickUp, Notion, Automattic.

#Changes

We'll post changes here and update the date at the top. For significant changes we'll also email account holders.

#Contact

privacy@stiqnote.com