Privacy Policy

Last updated: 2026-07-01

Handoff is a browser extension for capturing visual website feedback — screenshots, screen recordings, and comments — and making it available to your AI coding agent. There is also an optional web app where you can view and collaborate on that feedback with teammates. This policy explains what we collect, why, and who it is shared with. It is written to be short and human-readable.

The short version

• The extension collects data only when you actively use it — when you create a comment, capture a region or element, record your screen, or send a page to your agent. It does not run in the background watching your browsing.
• The extension and web app run no analytics, tracking pixels, or crash reporters. We do not sell your data, show ads, or log your keystrokes, mouse movements, or general browsing history. (The only visit stat we see is for our Chrome Web Store listing page — Google's store page, not the product — see below.)
• The extension needs no account. The optional web app asks for your email only so you can sign in and collaborate.
• You can delete any feedback you create at any time.

The Extension

The extension (Manifest V3) captures data only while you use one of its features. What it captures:

• Content you create:
  • Screenshots of the page region or element you select.
  • Screen recordings (video) and their audio, plus a text transcript of the audio, when you use record mode.
  • The comment text you write and the priority you set.
  • Page content you choose to capture with "Send page to AI": the page's text/markup and the selected element's markup.
• Technical context attached to a comment:
  • The URL of the page where you left the comment.
  • The selected element's CSS selector and its computed styles.
  • Optionally, console messages from the page, when relevant to the comment.
• Identifiers:
  • A randomly generated agent key (a token) that links your feedback to your install and to your AI agent. It is not derived from any personal identity.

Information stored only on your device

The extension keeps your agent key and a cache of your recent reviews in the browser's local extension storage (chrome.storage.local). This stays on your device and is removed when you uninstall the extension.

Microphone and voice recordings

Audio is captured only during an active screen recording, and only if you have enabled it. The extension never listens in the background. The recording and its transcript are part of the feedback you create and are uploaded with it (see below). You can delete a recording like any other comment.

Information uploaded when you create or share feedback

When you save a comment, finish a recording, send a page to your agent, or create a share link, the relevant content above is uploaded to our backend so it can be stored, shown back to you, and made available to your AI agent. When you create a public share link, the associated feedback becomes viewable by anyone who has that link, until you revoke it.

No analytics or tracking

We do not use any analytics, product telemetry, crash reporting, or tracking pixels in the extension or the web app. We do not collect your browsing history, the pages you merely visit, your clicks, scrolling, mouse position, or keystrokes.

The one exception is outside the product: our Chrome Web Store listing page — the store page hosted by Google, not the extension or this website — reports standard visit metrics (how many people view and install Handoff from the store, and which channel they arrived from) through the Web Store's built-in Google Analytics. That measures visitors to the store page only. It never runs inside the extension, on get-handoff.com, or against anything you do in Handoff.

What we do not collect

The extension does not collect names, emails, phone numbers, addresses, payment data, health data, or your browsing history. (Email is collected only if you choose to create a web-app account — see "The Website" below.)

The Website (optional web app)

You can use the extension on its own without an account. Separately, we offer an optional web app (a "Task Board") where you can view your feedback in one place and collaborate with teammates. If you choose to create an account there:

• We collect your email address so you can sign in. Sign-in is passwordless — an email magic link — handled by our authentication provider.
• If you invite a teammate, we store the email address you invite so we can send the invitation and grant access.

We use this only for authentication and team collaboration. We do not use it for advertising or profiling.

How we use information

We use the data solely to provide the product's features:

• Store and display the feedback you create.
• Make your feedback available to your AI agent through our MCP endpoint.
• Generate a public, read-only share link when you ask for one.
• Transcribe recorded audio so the transcript can accompany the recording.
• Authenticate you and enable team collaboration in the web app.

We do not use your data for advertising, profiling, credit or lending decisions, or any purpose unrelated to the product's core functionality.

How we share information (sub-processors)

Your data is processed by a small set of service providers that operate the backend on our behalf:

• Supabase — database and file storage. Stores your screenshots, recordings, transcripts, comments, and (if you create one) your account and team data.
• Groq — transcription. Converts recorded audio into text. Only the recorded audio is sent, and only when a recording exists.
• Vercel — hosting. Serves the web app and the public share page that renders a share link you create.

These providers process the data only to deliver the service. We do not sell your data or share it with third parties for their own purposes. We may disclose data if required by law.

Data retention and deletion

• Your feedback is retained until you delete it. You can remove individual comments, use Delete all to clear a site's feedback, and Revoke a public share link to disable it.
• Account and team data is retained while your account exists; you can request deletion of your account and its data.
• Locally cached data is cleared when you uninstall the extension.

Security

We use reasonable technical and organizational measures, including encryption in transit (HTTPS/TLS), to protect your data in transit and at rest. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International data transfers

Our service providers may process and store data in data centers located in different countries. By using the product, you understand that your data may be transferred to and processed in jurisdictions other than your own.

Your choices and rights

• You can delete individual comments, delete all feedback for a site, and revoke any public share link at any time.
• You can regenerate (rotate) your agent token, which invalidates the old one.
• You can request access to or deletion of your account data. Depending on your jurisdiction (for example, the EEA or UK), you may have additional rights over your personal data; contact us to exercise them.

Children

The product is a developer tool and is not directed to children. We do not knowingly collect data from children under 13 (or under 16 in the EEA).

Permissions

The extension requests only the permissions needed for its features: access to pages (to capture screenshots/recordings and place comments), tabs, local storage (for your key and cache), an offscreen document (for recording), the side panel and notifications (for the UI), and clipboard write (to copy links and images).

Changes to this policy

We may update this policy. Material changes will be reflected by updating the "Last updated" date above.

Contact

Questions about this policy or your data: hello@get-handoff.com