Privacy Policy

Last updated: July 31, 2026

Plannotator does not collect usage telemetry or analytics. Plans, documents, diffs, annotations, drafts, history, and configuration stay on your machine by default. Some features contact GitHub, your Git remote, a URL you ask Plannotator to fetch, an AI provider, or a hosted sharing service. Those boundaries are described below.

1. What this policy covers

This policy covers the open source Plannotator application, plannotator.ai, share.plannotator.ai, the hosted short-link service, and the Workspaces waitlist in this repository.

It does not control third-party AI providers, Git hosts, websites you fetch, services through which you send a share link, or self-hosted deployments. Those services apply their own terms and privacy practices.

2. Data that stays local by default

The open source application runs a local server and opens the review UI in your browser. It stores Plannotator-managed files under ~/.plannotator by default, or under PLANNOTATOR_DATA_DIR when configured. These files can include:

• plan and annotate version history
• annotation drafts and saved review decisions
• configuration, session records, guide history, and diagnostic logs

Some UI preferences are stored as functional browser cookies. Plannotator does not send this local review data to the Plannotator project owner as telemetry or analytics.

3. Automatic network requests

GitHub release check

Each time a plan review, annotate, archive, share-portal, or code-review app surface loads, it makes one GET request to GitHub's public latest-release API to check whether a newer Plannotator version exists. The request has no plan, document, diff, annotation, or usage-event payload. The Plannotator project owner does not receive usage analytics from this check. GitHub receives an ordinary web request and may process information such as your IP address, user agent, and request origin under GitHub's privacy practices. There is currently no configuration or environment-variable opt-out. Dismissing an update notice only hides that release notice; it does not stop later checks.

Installer downloads

The install scripts download the selected Plannotator binary and checksum from GitHub Releases. When installing the latest version, they first query GitHub's API to resolve the release tag. If available, a token from GITHUB_TOKEN, GH_TOKEN, or gh auth token is sent to that API. Pinning --version skips only the release-resolution API call; the binary and checksum still come from GitHub Releases.

A full install can also clone Plannotator from GitHub to install agent integrations, download the optional sem sidecar from the Ataraxy-Labs/sem GitHub repository, ask Pi to install @plannotator/pi-extension from npm, run npx skills add when you select extra skills, and use npm to install the managed agent-terminal runtime. Provenance verification, when enabled, also contacts GitHub through gh. Minimal mode and the applicable skip flags omit their corresponding optional components.

Git remote checks during local code review

For a local Git review, Plannotator may run git ls-remote origin in the background to identify the remote default branch and tell you when the local baseline is behind. This contacts the Git host configured as origin, but does not send the local diff. Choosing the in-app Fetch action runs git fetch.

4. Features that send data when used

URL annotation and Jina Reader

When you ask Plannotator to annotate a URL, Plannotator requests that URL. Public URLs may first be requested directly for content negotiation and, when Jina is enabled, the URL is also sent to Jina Reader so Jina can fetch and convert it. If Jina fails or is disabled, Plannotator fetches the URL directly. Local and private-network URLs skip Jina. The requested site or Jina receives normal request metadata, and a configured JINA_API_KEY is sent to Jina.

GitHub and GitLab reviews

Reviewing a hosted pull request or merge request uses your authenticated gh, glab, and Git configuration to fetch the diff, metadata, comments, checks, repository content, and related remote refs. Plannotator can also query author avatars and refresh review discussions. Posting review comments or changing provider-side viewed state happens only through the corresponding review actions. GitHub, GitLab, or your self-hosted forge processes these requests.

In local Git commit review, Plannotator may also look up commit-author avatars. For GitHub remotes it fetches recent commit metadata and matches returned email addresses locally; it does not send the local commit-author email to GitHub for that match. For GitLab remotes it sends commit-author emails to the configured GitLab instance's avatar endpoint: one email per request, up to ten in parallel per lookup round; overflow is retried in later rounds. If an avatar is found, your browser requests the returned image URL from GitHub, GitLab, Gravatar, or another image host.

Ask AI and review agents

Ask AI, Guided Review, Code Tour, and review agents use an AI provider or agent CLI that you select and have already configured. A request can include your question, selected text, and relevant plan, document, repository, or diff context. Plannotator does not route this AI content through a Plannotator-operated model proxy, but the selected provider may process or retain it under your account and that provider's policy. Claude Ask AI allows WebSearch by default, so a question can also send a search query to Anthropic's search service and return third-party web results.

Review-agent permissions depend on the selected engine. Claude allows file-reading tools and Git or forge command patterns intended for inspection, while denying direct file-writing tools, WebFetch, WebSearch, and general-purpose shells; some allowed Git and forge patterns are broader than a strict read-only subcommand list. Copilot denies its direct write tool and specific high-risk version-control and forge operations, allows Git and forge command families, and auto-denies other shell tools. Codex runs in its --full-auto workspace-write sandbox. Cursor runs in ask mode with its sandbox enabled by default unless you opt out. OpenCode's plan agent and Pi retain shell access under their own CLI and runtime controls; Pi removes its direct edit and write tools but does not remove Bash. Plannotator tells every engine not to modify files or post comments, but those prompt instructions are not the same as structural enforcement.

Share links

Open source asynchronous link sharing remains available for compatibility but is moving to deprecated support. Workspaces is the primary direction for team sharing. No removal date has been announced.

URL-fragment shares: For markdown shares that fit in a URL, Plannotator compresses the shared plan and annotations into the fragment after #. This content is compressed, not encrypted. Browsers do not include the fragment in the HTTP request to the share portal, so the portal host does not receive the shared content through that request. The browser still requests the portal page, and its host receives ordinary request metadata. Anyone or any messaging service that receives the full link can read or retain the shared content.

Encrypted short links and raw HTML: For markdown, clicking Create short link confirms the upload. Plannotator encrypts the share payload with AES-256-GCM before uploading ciphertext to the paste service. The decryption key is placed in the URL fragment and is not included in the paste or portal HTTP request. Anyone with the complete link can decrypt the content. The hosted paste service expires ciphertext after seven days.

Raw HTML cannot use a hash-only share. In a local raw-HTML session, invoking the header's Copy Share Link action or a configured Approve or Send Feedback callback action can create and upload the encrypted short link immediately, without the markdown Create short link confirmation. A remote raw-HTML session creates the encrypted short link automatically at session creation so the HTML can be opened from another machine. In remote mode, markdown sessions still print a hash-based link.

Callback-enabled links and remote resources

A share-link creator can choose any http:// or https:// callback endpoint and include a token. If you use the link's Approve or Send Feedback button, the browser posts the action, token, and annotated share URL to that endpoint. For an encrypted short link, annotated_url can contain the complete URL, including the fragment decryption key. Treat the link creator and callback endpoint as trusted with the shared content and key. Prefer HTTPS because HTTP does not provide transport encryption.

Plans, documents, raw HTML, and hosted PR descriptions can reference remote images, video, fonts, or other assets. Your browser may request those resources from their hosts when it renders them. The app bundles its default fonts and syntax-highlighting assets, but selecting a hosted code-review font can request Google Fonts or jsDelivr. Opening an in-app help video loads a privacy-enhanced YouTube embed; YouTube receives the request and may store or access data when you interact with the video.

5. Website and Workspaces waitlist

Our websites and hosted services use infrastructure such as AWS, Amazon CloudFront, and Cloudflare. These providers may process IP addresses, request headers, timestamps, and similar delivery or security metadata. The marketing site loads fonts from Google Fonts, contributor avatars from GitHub's image hosts, a release badge from Shields.io, repository information through GitHub's API, and privacy-enhanced YouTube embeds on some blog posts. Opening those pages sends ordinary requests to the corresponding third parties. YouTube may also store or access data when you interact with an embedded video.

We do not operate advertising trackers, usage analytics, analytics cookies, or product telemetry on these sites. Functional cookies may remember theme, review settings, and a dismissed update notice.

Workspaces is a separate hosted product and the primary team-sharing direction. The local-storage statements for the open source application do not describe Workspaces. This public repository contains the current Workspaces waitlist, not the hosted product implementation.

If you join the waitlist, we store the information you submit: email address, company, team size, optional note, and whether you identify as a contributor. If you leave company blank and use a non-free email domain, the service can infer a company name from the domain and records that the value was inferred. The service also records IP address, country, user agent, and referrer for rate limiting, abuse prevention, and signup context. Cloudflare Turnstile processes a verification token and related request data. We use waitlist data to manage beta access, contact you about Workspaces, and cross-reference contributor status when requested.

6. Retention

• Local Plannotator files remain on your machine until you delete them or use the applicable cleanup controls.
• Hosted encrypted short-link ciphertext expires after seven days. A self-hosted operator can configure a different period.
• Workspaces waitlist entries are retained while needed to run the waitlist, contact applicants, and keep basic signup records. You can request deletion.
• Support emails are retained as needed to respond and keep a record of the conversation.
• Infrastructure and third-party providers may retain request or security data under their own policies.

7. Your choices

• Set PLANNOTATOR_SHARE=disabled to hide the open source sharing controls.
• Set PLANNOTATOR_JINA=0 or use --no-jina to prevent URL annotation from using Jina. The requested URL is still fetched directly.
• Set PLANNOTATOR_AI=disabled to disable the in-app AI and review-agent surfaces.
• Self-host the share portal and paste service, or do not use link sharing.
• Do not send a share link through a service you do not trust with the content or key in that link.
• The automatic GitHub release check currently has no opt-out setting.

8. Security

Client-side encryption limits what the paste store receives, but it does not protect a link after you share it. Treat the complete URL as the secret. Compression is not encryption, so hash-only links must also be shared only with trusted recipients and services. A callback recipient can receive a complete annotated short-link URL, including its decryption key, so use only a trusted callback target.

No internet service or client-side application can guarantee perfect security. For sensitive or regulated work, review the source and your provider policies, disable optional network features, and self-host where appropriate.

9. Contact and privacy requests

Michael Ramos
Email: backnotprop@gmail.com

You may ask for access to, correction of, or deletion of personal information we hold about you. We generally cannot identify or recover hash-fragment content, local files, or encrypted paste content from the decryption key because we do not receive that key.

10. Changes to this policy

We may update this policy when Plannotator's behavior or hosted services change. The date at the top identifies the current version.