Last updated September 26, 2026

Privacy policy

Annotate Ltd. ("Annotate", "we", "us") runs getannotate.dev, the Annotate API, the MCP server, and the Claude plugin (together, the "Service"). This policy describes how we handle Personal Data when you use the Service.

"Personal Data" means information that identifies you, or could reasonably be used to identify you, such as your email address or IP address.

This policy applies when you:

• Visit getannotate.dev or read a Markdown file without an account
• Convert a file to Markdown in the browser, over the API, or through the Claude plugin
• Create an account and sign in
• Save, share, or comment on a document
• Connect a GitHub repository
• Buy a paid plan
• Receive email from us

Annotate Ltd. is the controller of the Personal Data described here, for the purposes of the Israeli Privacy Protection Law, the GDPR, and similar laws. Some sections apply only where a specific law applies to you.

It is written to be checked against the product. If something here doesn't match what you observe, email security@getannotate.dev and we'll fix one or the other.

1. What we collect, why, and how we use it

1.1 Reading a file without an account

When you drop a .md file on the page, it renders in your browser. The file is not uploaded, and we don't keep a copy.

The site is hosted on Vercel, which receives the standard request data any website receives: IP address, user agent, requested URL, and timestamp.

1.2 Converting a file to Markdown

Files you convert — PDF, .docx, .pptx, .xlsx, .csv, HTML, images, and the other formats listed on the Convert page — are sent over HTTPS to the Annotate conversion service, which runs on Railway in an EU data center in Amsterdam.

• Conversion, including text recognition in images and scanned PDFs, runs in our own software. No third party receives the file.
• The file is converted and returned as Markdown. It is not written to a database or storage bucket, and it is not read by a person.
• The converted Markdown is kept only if you save it as a document.
• Files up to 50 MB are accepted.

1.3 Creating an account

Sign-in is handled by Firebase Authentication. You can sign in with Google or with a link sent to your email address. There are no Annotate passwords.

Firebase processes:

• Your email address
• Your display name and profile photo, if you sign in with Google
• Your Google or Firebase user ID
• Your IP address and user agent, used by Firebase to prevent abuse during sign-up and sign-in

Google acts as our processor for this data under the Firebase Data Processing and Security Terms. Details: Privacy and Security in Firebase.

1.4 Saving documents, comments, and notes

When you save a document, we store:

• The Markdown content
• Your highlights, comments, and notes, with the character offsets they are anchored to
• Revision history and synced history, up to your plan's storage limit (30 MB, 500 MB, or 3 GB)
• The author and timestamp of each comment

Notes are private to you. Comments are visible to anyone who can open the document. Documents and annotations are stored on Supabase, in an EU data center in Frankfurt.

1.5 Sharing a document

• Unlisted link. Anyone with the link can read and comment without an account. For someone commenting without an account, we store no name, email address, or IP address. We store a random anonymous ID in their browser, which persists across sessions on that browser and device so their comments stay attributed to them. Treat an unlisted link like a password: anyone who has it can open the document.
• Email sharing. We store the email addresses you invite and send each one an invitation through Mailgun. Only invited readers can open the document.
• Workspaces (Teams). Members of a workspace can see the documents in it, according to the access you set.

Nothing is shared until you share it.

1.6 Syncing with GitHub

GitHub sync uses the Annotate GitHub App. Permissions are requested in 2 steps, and only when you need them:

1. When you connect a repository: contents: read and metadata: read. This lets us list files and pull Markdown into Annotate.
2. When you first push changes back: pull_requests: write and issues: write. GitHub asks you to approve this separately. This lets us open a pull request with your comments and notes.

About that access:

• The App can read the contents of every repository you install it on, not only .md files. Install it on selected repositories if you want to limit it.
• Your GitHub access token is never written to our database or logs. It is held in memory for the length of a request and then discarded.
• Files you pull into Annotate are stored as documents, as described in 1.4.
• Comments and notes you sync back are opened as a pull request in your repository.

1.7 Using the API, MCP server, or Claude plugin

• API keys (mdvk_…) are created in Settings → API Keys. We store only a SHA-256 hash of each key, so we can't show a key again after it's created.
• The Claude plugin sends a file to us only when its extension is on the supported list returned by GET /api/convert/extensions. All other files stay on your machine. The hook acts only on the Read tool.
• Over MCP, an agent can read the documents and annotations your key has access to.

1.8 Paying for a plan

Checkout is handled by Paddle, which acts as the merchant of record. Paddle collects your payment details and billing address directly and is the controller of that data under its own privacy policy. We receive your email, country, plan, and subscription status. We never receive card numbers.

1.9 Email

We send service emails — sign-in links, invitations, and security notices — to operate your account. We send marketing email only if you opt in. Every marketing email has an unsubscribe link, and unsubscribing doesn't stop service emails.

1.10 Why we use it

1.11 What we don't do

• We don't sell or rent Personal Data.
• We don't show ads.
• We don't use your files, documents, comments, or notes to train machine learning models, and we don't allow our service providers to.
• We don't read your documents, except when you ask us to for support, or when required by law.

1.12 Your content

You are responsible for the documents you upload, convert, save, share, or sync, and for having the right to use them. Don't use Annotate to store or share content that is illegal, infringes someone else's rights, or could harm anyone.

We don't review document content, and we aren't responsible for it. Content shared through an unlisted link or pull request is visible to whoever you give access to. Keep secrets, credentials, and personal data about others out of documents unless you need them there.

We may remove content or suspend accounts that violate these rules or our Terms.

2. How we protect and retain your data

2.1 Security

• All traffic is encrypted with HTTPS.
• Account data in Firebase Authentication and documents in Supabase are encrypted at rest.
• GitHub tokens are never persisted.
• API keys are stored only as SHA-256 hashes.
• The Claude plugin's hook ships as readable source (annotate-filter.py) so you can review it before installing.

No system is perfectly secure. If we become aware of a breach affecting your data, we'll notify you and the relevant authorities as required by law.

To report a vulnerability: security@getannotate.dev

2.2 Retention

3. How we share your data

We share Personal Data only with the service providers below, only to run the Service, and under a data processing agreement — or, for Paddle, its own privacy policy as merchant of record.

We may also disclose Personal Data:

• To comply with a law, court order, or valid request from a public authority
• To protect the rights, safety, or property of our users, the public, or Annotate
• To a buyer or successor if Annotate Ltd. is merged, acquired, or sells its assets. We'll tell you before your data becomes subject to a different privacy policy.

4. International transfers

Annotate Ltd. is based in Israel, which the European Commission recognizes as providing adequate protection for Personal Data.

Documents are stored, files are converted, and email is sent inside the EU. Sign-in and analytics data are processed by Google in the United States. Hosting, GitHub sync, and billing also involve US providers.

Where Personal Data leaves the EEA, UK, or Switzerland, the transfer relies on one of:

• An adequacy decision under Article 45 of the GDPR, including the EU-U.S. Data Privacy Framework for certified providers such as Google
• Standard Contractual Clauses approved by the European Commission

5. Your privacy rights and deleting your account

5.1 Your rights

Depending on where you live, you may have the right to:

1. Know what Personal Data we hold about you, and get a copy
2. Correct inaccurate data
3. Delete your data (the "right to be forgotten")
4. Receive your data in a portable format
5. Restrict how we process your data
6. Object to processing based on legitimate interest
7. Withdraw consent at any time, without affecting processing that happened before
8. Complain to the Israeli Privacy Protection Authority or your local data protection authority

To exercise any of these, email security@getannotate.dev. We'll respond within 30 days, and may ask you to confirm your identity first.

5.2 Controls in your account

• Delete any document, comment, or note. Deletion is permanent.
• Export any document as a .md file
• Revoke an unlisted link or remove an invited reader
• Uninstall the GitHub App from GitHub settings → Applications. This stops future syncs. It doesn't remove documents already pulled into Annotate — delete those separately.
• Revoke an API key
• Turn analytics off in Cookie settings

5.3 Unsubscribing from marketing email

Use the unsubscribe link at the bottom of any marketing email.

5.4 Deleting your account

Deleting your account deletes your documents, annotations, and API keys, and deletes your Firebase Authentication record. Google removes that record from its live and backup systems within 180 days.

Deleting your account doesn't remove pull requests already opened in your repositories, or copies of a document that readers saved themselves.

6. Use by children

Annotate is not directed at children under 13, and we don't knowingly collect Personal Data from them. If you believe a child under 13 has created an account, email security@getannotate.dev and we'll delete it.

7. Third-party services

Parts of the Service connect to products we don't run: GitHub, Claude and other MCP clients, and Paddle. Once data reaches one of them — a pull request in your repository, a document an agent read over MCP, a payment at checkout — it is governed by that provider's terms and privacy policy. We aren't responsible for their privacy practices.

8. Log files

Our servers log each request with the endpoint, response status, timestamp, and API key ID where one is used. Conversion logs also record file extension and file size. File contents are never logged. We use logs to enforce rate limits, detect abuse, and fix errors, and delete them after 7 days.

9. Cookies and analytics

• Necessary. A Firebase session keeps you signed in. It can't be turned off without breaking sign-in. The anonymous commenter ID described in 1.5 is stored in your browser.
• Analytics. We use Google Analytics for Firebase to understand how the product is used: pages viewed, features used, device and browser type, and approximate location derived from IP address. It sets cookies in your browser and loads only after you consent. Google processes this data under the Google Analytics terms and the Google Privacy Policy. You can also opt out with the Google Analytics opt-out add-on.

You can change your choice at any time in Cookie settings. You can also block or delete cookies in your browser settings.

10. California privacy rights

10.1 CCPA

If you live in California, you have the right to know what Personal Information we collect and how we use it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We don't sell or share Personal Information as those terms are defined under the CCPA. To make a request, email security@getannotate.dev.

10.2 Shine the Light and Do Not Track

We don't disclose Personal Information to third parties for their own direct marketing, so California Civil Code Section 1798.83 doesn't apply. We don't respond to Do Not Track browser signals, because no common standard for them exists.

11. Changes to this policy

We'll update the date at the top when this policy changes. For material changes, we'll email account holders at least 7 days before they take effect.

12. Contact us

Annotate Ltd.
Kremenetski St 2, Tel Aviv 6744320, Israel
security@getannotate.dev