Your words
are yours.
Pro Preview shared content is designed to be encrypted before reaching the relay. Personal annotations are stored locally in your browser profile.
Basic Chrome extension
The basic edition provides personal annotation without accounts, team invitations, relay connections, or cloud sync. It processes webpage text and URLs locally to place and restore your highlights, notes, and drawings. Annotation content, page URLs, and activation preferences are stored in Chrome’s local extension storage in your browser profile. They are not sent to Quillcrypt or sold, shared for advertising, or used for credit or lending decisions.
You can delete annotations in the extension. Clearing the extension’s storage or uninstalling it removes its local data. Local annotations are not claimed to be encrypted at rest. The basic extension does not load remote executable code or collect analytics. Opening a website link, such as this privacy policy, sends ordinary browser connection metadata to the website host. The collaboration and account sections below describe the separate Pro Preview functionality, which is not enabled in the basic edition.
Quillcrypt’s use of user data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Contact extensions@thehighlama.com with privacy questions.
Collaboration is in Pro Preview. Local notes are not claimed to be encrypted at rest. Website contact details are separate from encrypted annotation content.
What stays.
What leaves.
The boundary changes when you move from personal annotation to a shared workspace.
Stays on your device
- Personal annotation records
- Readable workspace content
- Workspace keys
- Visible page content used for anchoring
Leaves your device
- Encrypted workspace updates
- Workspace and room routing metadata
- Account, plan, seat and linked-device metadata
- Standard connection metadata
Quillcrypt can read.
On your device, the extension reads visible page content to anchor and render annotations. The relay can see workspace scope, routing, timing, traffic volume, and IP address. Member-removal coordination stores device public keys, opaque key epochs, and sealed per-device envelopes.
Quillcrypt cannot read at the relay.
Notes, highlighted text, drawn annotation content, plaintext workspace keys, and decrypted collaborative payloads. A sealed rotation envelope can be opened only by its destination device.
No analytics SDK is installed.
The repository contains no Google Analytics, GTM, Plausible, PostHog, Mixpanel, Sentry, Vercel Analytics, or general browsing telemetry integration.
This does not mean zero operational metadata. Hosting and network services receive connection metadata, which may include IP addresses. No shipping integration is included in this offer.
Backups remain encrypted.
A password-protected workspace-key backup preserves key material, not a complete annotation archive. It can restore key access in another browser profile. Quillcrypt cannot recover a lost password or a key when both device access and recovery material are gone.
DeviceWorkspace keys→ExportEncrypted backup→New profileImport and restore Website preview requests
Preview intake is not currently open. Before collection opens, the request-data policy, secure reviewer access, and deletion process must be approved. The proposed retention period is 90 days for unaccepted requests.
Preview details are ordinary contact data stored in the website’s Supabase service, not end-to-end encrypted workspace annotations. Access is limited to authorized reviewers. Submitting a request does not subscribe you to unrelated marketing. Short-lived HMAC identifiers protect rate limits; application analytics do not receive raw IPs or request content. Hosting access logs are a separate operational boundary.
To request deletion or ask about your data, email extensions@thehighlama.com. Contact emails are handled through the email service and are not encrypted workspace annotations.
Deletion
Leaving a workspace removes its local key but does not erase copies held by other members. Account and identity deletion have a 14-day recovery window. Identity deletion is blocked while you own a team account and completes only after personal-account billing, relay, device, rotation, and metadata cleanup; minimal completion tombstones remain.
Linked devices
Single-use connection codes and extension device credentials are stored only as one-way hashes. Account Settings can revoke a device, preventing new five-minute relay capabilities.
Third parties
Website hosting and Supabase process website service data. No marketing analytics provider is configured. The extension does not collect analytics; the website marketing adapter is disabled.
Questions
Product and privacy questions can be sent to extensions@thehighlama.com.
Read the technical boundary.
Security architecture ↗