pinuu

Pinuu Privacy Policy

Effective Date: October 17, 2026 • Version 1.0

Our Core Privacy Principle

Pinuu is a paid, subscriber-supported product. We do not sell ads, we do not monetize user data, and we do not track your browsing history. We collect only the minimum data required to anchor your notes, replies, and reactions to specific web elements.

1. Data Collected by the Pinuu Web Extension

When you use the Pinuu extension, we collect and process only what you explicitly interact with:

  • Anchored Notes & Quotes: When you select text or pin an element and submit a take, we store your note text, the exact quote snippet, the normalized URL hash, and DOM selector metadata (such as element tag or video timestamp) according to the W3C Web Annotation standard.
  • Reactions & Replies: Reactions (e.g. thumbs up, flame, heart) and replies you post to other members' notes.
  • User Preferences: Display preferences (such as selected language filters) stored locally in your browser via chrome.storage.sync.
  • Authentication Session: Your verified subscriber token stored in chrome.storage.local to authenticate API requests.

2. What We Do NOT Collect

  • We do not track, log, or record the web pages or URLs you browse.
  • We do not transmit the full HTML or DOM tree of pages you visit.
  • We do not log keystrokes outside of Pinuu's isolated composer modal.
  • We do not collect personal passwords, financial credentials, or private form data.
  • We do not use third-party analytics trackers, ad pixels, or behavioral fingerprinting scripts in the extension.

3. Why We Request <all_urls> Host Permissions

Pinuu operates as a universal social layer for the open web. To enable subscribers to anchor notes to quotes or video timestamps on any website of their choosing (e.g. Wikipedia, Bloomberg, Substack, YouTube), the extension requests access to web pages.

Before querying notes for a given page, Pinuu checks an in-memory Bloom filter of active domains. If a website contains no notes from your network, no network requests are made. Content scripts render all UI within an isolated Shadow DOM to prevent any collision or data leakage with host website scripts.

4. Payments and Billing Information

All subscription billing is handled through PCI-DSS Level 1 certified payment providers (Stripe / Lemon Squeezy). Pinuu never stores or processes raw credit card numbers or banking credentials.

5. Contact & Data Deletion Requests

You may request full export or permanent deletion of your account, notes, and profile data at any time by contacting:
privacy@joinpinuu.app