Pin & FixPrivacy Policy
Effective date: 3 November 2026
This policy covers the Pin & Fix Chrome extension (“the extension”), its optional local MCP server for AI tools, and the website pinandfix.com. In short: Pin & Fix has no server of its own. Everything you create is stored in your own Google account and in your browser. The developer does not receive, store, sell or share your data.
1. Who is responsible
Pin & Fix is developed and published by Paweł Limanówka, a private individual in Kraków, Poland (not a trader). Contact: hello@pinandfix.com.
2. What the extension accesses and why
Your Google account: name and email address
Read from the Google Drive API (about: display name and email address) after you sign in with Google. Used to sign your notes and replies
with your name, to show which account you are signed in as, and to tell when an invitation was sent to a different account.
Google Drive files: only the ones the extension creates or you pick
The extension requests a single Google OAuth scope, https://www.googleapis.com/auth/drive.file. With it, Pin & Fix can access
only files it created or that you explicitly chose (in the Google file picker on pinandfix.com or through an invitation link). It cannot list, read or change
any other file in your Drive. With these files it:
- creates one Google Sheet per website (“Pin & Fix — example.com”), and reads and appends rows to it: your notes, replies, status changes and screenshots;
- reads the sheet’s metadata (whether you can edit it, the owner’s name and email, whether it is in the trash) to show the right options;
- when you click Share, adds the email address you enter as a collaborator on that sheet; Google then emails that person an invitation.
What you pin on a web page
Only when you create a note, the extension records:
- the page address (URL) and title;
- the element you clicked: a CSS selector, its text, and hints to find it again (tag name, id, classes, link or image address, nearest heading), its position on the page and your window size;
- a screenshot of the area around that element, cropped from the visible part of the tab;
- your comment and, if you type one, the suggested new text.
To draw numbered circles on pages that already have notes, the extension reads the page in your browser and finds the noted elements. This happens locally and is not stored. Pin & Fix asks Chrome for access to a website only for websites you use it on, and you can withdraw that access in Chrome at any time.
Settings and state in Chrome storage
| Where | What |
|---|---|
chrome.storage.sync | Which sheet belongs to which website, a marker of the last note you have seen per sheet, email addresses you shared a sheet with (to suggest them later, up to 20 per sheet), display preferences. If Chrome sync is on, Chrome syncs this between your signed-in browsers. |
chrome.storage.local | Notes and screenshots waiting to be written to your sheet (for example while you are offline), your Google name and email (so notes can be prepared offline), small flags such as which sheets were already set up. |
Google sign-in tokens are managed by Chrome (chrome.identity); the developer never sees them.
3. Where your data goes
- Google. Notes and screenshots are written to your Google Sheet through the Google Sheets and Drive APIs, over HTTPS. Google’s Privacy Policy applies to data in your Google account.
- People you share with. Everyone with access to a sheet can see its notes, screenshots, and the names and email addresses of the people who wrote them. You control this with Google Drive sharing.
- Email you choose to send. The “Email” buttons open a pre-filled Gmail draft in your browser. Nothing is sent until you send it yourself.
- AI tools you choose to use. Copy for AI puts the text of your notes on your clipboard; whatever you paste into an AI service is governed by that
service’s terms. The optional local MCP server runs on your own computer, signs in to Google with the same
drive.filepermission, keeps its sign-in token in a file on your computer, lists the Pin & Fix sheets that permission lets it see (to know which website’s notes to read), and passes notes and screenshots from your sheet to the AI tool you connected it to (for example Claude Desktop, Claude Code, Cursor or VS Code). - The developer: nothing. There is no Pin & Fix server. The extension contains no analytics, telemetry, advertising or tracking code, and sends no data about you or your browsing to the developer or to anyone else.
4. The website pinandfix.com
pinandfix.com is a static website. It sets no cookies and runs no analytics or tracking. It is hosted by Cloudflare, which processes technical request data such as IP addresses to deliver the pages and protect them from abuse (Cloudflare Privacy Policy).
Three pages work together with the extension in your browser: join (accepting an invitation), open (links from notification emails) and
pick (choosing a shared sheet). The pick page loads the Google file picker from Google and hands it a short-lived access token from the extension
(drive.file only); the file you pick is reported back to the extension in your browser. The extension gives tokens only to pinandfix.com.
5. Google API Services User Data Policy
Pin & Fix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- Google user data is used only to provide the features you see in the extension: writing, reading and sharing your notes.
- It is not transferred to anyone, except as you direct (sharing a sheet, sending an email, copying notes to an AI tool), as necessary for security, or to comply with the law.
- It is not used or transferred for advertising, including personalised or retargeted advertising, and it is never sold.
- It is not used to determine creditworthiness or for lending purposes, and not used to train AI or machine-learning models.
- No human reads it. The developer has no copy of it.
The extension also complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
6. Keeping, deleting and revoking
- Retention. Your sheet stays in your Google Drive until you delete it. You can delete single rows or the whole file at any time in Google Sheets or Drive. The developer keeps nothing, so there is nothing to delete on our side.
- Revoke Google access at myaccount.google.com/permissions: select Pin & Fix and remove its access. Your sheets stay in your Drive.
- Uninstall the extension in
chrome://extensions. Chrome removes the extension’s storage. - Local MCP server. Remove it in your AI tool, and delete the folder
~/.config/pinandfix(Windows:%APPDATA%\pinandfix) on your computer to remove its sign-in token.
7. Your rights
Depending on where you live (for example under the EU GDPR), you have rights to access, correct, delete and export your personal data and to object to its processing. Because your Pin & Fix data is in your own Google account, you can do all of this directly in Google Sheets and Drive. For any question, write to the contact address above. You may also complain to your data protection authority.
8. Children
Pin & Fix is not directed at children under 16 and is not knowingly used to collect data from them.
9. Changes to this policy
If this policy changes, the new version will be published on this page with a new effective date. If a change affects how your data is used, it will be announced in the extension’s release notes before it takes effect.