Privacy Policy

Single Purpose Description

Trace allows users to draw and annotate directly on any website. Users can create persistent visual notes that are saved per URL, export annotations as screenshots, and access a floating toolbar with drawing tools (pen, shapes, text). The extension serves as a productivity overlay for marking up web content.

Overview

Trace is a browser extension that respects privacy. This Privacy Policy explains how data is handled.

Data Collection

No personal data is collected. Trace operates entirely locally within your browser:

• All drawings and annotations are stored locally using IndexedDB
• No data is sent to external servers
• No user accounts or tracking
• No analytics or telemetry

Permission Justifications

Trace requires the following browser permissions to function:

activeTab

Required to enable the drawing overlay on the currently active tab when invoked via keyboard shortcut (Alt+T) or by clicking the extension icon. This allows temporary access to the current page to inject the annotation canvas only when explicitly triggered. No data is collected or transmitted.

debugger

Used exclusively for the "Export with Screenshot" feature. When exporting annotations with a full-page screenshot, the extension temporarily attaches the Chrome DevTools Protocol to capture the entire webpage including content below the visible viewport. The debugger is attached only during the export action and immediately detached. No remote debugging or external connections are made.

downloads

Required to save exported annotation images to the local computer. This permission triggers a file download dialog when users export drawings as PNG files. Downloads are only initiated when explicitly requested and no existing files on the system are accessed.

Host Permissions (<all_urls>)

Essential because Trace is a universal annotation tool that must work on any website. The extension injects a content script containing the drawing canvas overlay onto web pages. This overlay is mounted in a Shadow DOM as a transparent layer above page content. Sensitive domains (financial institutions, healthcare portals, government sites) are explicitly excluded via the exclude_matches directive in the manifest.

scripting

Required to inject the content script into tabs when toggling the drawing overlay on tabs where the content script hasn't been automatically injected. Also used during screenshot capture to temporarily hide and show UI elements for correct export rendering.

storage

Required to persist data locally in the browser. This includes: (1) saving drawing annotations (strokes, shapes, text) to IndexedDB, associated with specific URLs; (2) storing toolbar position preferences; and (3) tracking which tab has the overlay active for keyboard shortcut handling. All data remains on the device and is never transmitted externally.

tabs

Used to: (1) query all open tabs when broadcasting overlay toggle state changes, ensuring the extension icon reflects the correct state; (2) check for saved annotations when navigating to a URL, allowing the badge to indicate when notes exist; and (3) get tab information during screenshot export operations. This enables coordination across browser tabs.

Remote Code

This extension does not use remote code. All code is bundled at build time and packaged within the extension. No external scripts are loaded, executed, or evaluated at runtime. The extension operates entirely with locally bundled JavaScript, HTML, and CSS files.

Third-Party Services

Trace does not use any third-party services, analytics, or external APIs. The extension operates completely offline without network requests.

Data Retention

Your drawings are stored in your browser's IndexedDB until you choose to delete them. You can clear all data at any time by:

• Using the "Clear" button in the extension toolbar
• Uninstalling the extension, which removes all stored data
• Clearing browser data for this extension

Changes to This Policy

This Privacy Policy may be updated from time to time. Any changes will be posted on this page with an updated "Last updated" date.

Contact

For questions about this Privacy Policy, contact b-raffetseder.com.