Privacy Policy

Pinpoint is a visual feedback tool that lets teams drop pins on any webpage, capture screenshots, and leave contextual comments. We are committed to handling your personal data with care, transparency, and respect.

This Privacy Policy applies to the Pinpoint web application, Chrome browser extension, and any related services operated by Greyfeathers Studios Pvt Ltd. By using Pinpoint you agree to the practices described here.

We are the data controller for personal information you provide directly to us. For information stored on your behalf (screenshots, comments) we act as data processor on your instruction.

We only collect what is necessary to provide the service.

• To create and manage your account.
• To display your name and avatar inside shared projects.
• To send transactional emails — invite links, password resets, and access request notifications.
• To send in-app notifications when comments or replies are posted.
• To deliver Slack notifications if you connect a Slack workspace.
• To resolve bugs and improve the product based on aggregated usage patterns.

We do not sell your data. We do not use your data for advertising. We do not share your data with any third party except as described below.

We share your data only with the service providers necessary to operate Pinpoint, all of whom are bound by confidentiality obligations:

We will disclose your data if required by law or to protect the rights, property, or safety of Greyfeathers Studios, our users, or the public.

The Pinpoint Chrome extension requests the following browser permissions. None of these are used passively — the extension only activates when you explicitly click the extension icon and start a review session.

Screenshots are captured only at the moment you right-click to leave a comment. The extension does not run in the background, does not read page content, and does not transmit any data unless you are in an active review session.

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Account data (name, email) is retained until you delete your account.
• Project data (comments, screenshots, replies) is retained until the project owner deletes the project.
• Auth tokens expire automatically and are rotated on each session.
• On account deletion, all personal data is removed within 30 days.

We take reasonable technical and organisational measures to protect your data:

• All data is transmitted over HTTPS/TLS.
• Database access is protected by Row Level Security (RLS) — users can only access projects they belong to.
• Screenshots are stored in private Supabase Storage buckets and served via signed URLs.
• Passwords are never stored in plaintext — authentication is handled by Supabase Auth.
• Service role keys are stored as server-side environment variables and never exposed to the browser.

No method of transmission over the internet is 100% secure. If you discover a security issue please contact us immediately at support@greyfeathers.io.

Pinpoint uses browser storage (cookies and localStorage) solely for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

Pinpoint is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of Pinpoint after changes are posted constitutes your acceptance of the revised policy.

For any questions, requests, or concerns about this Privacy Policy or your personal data, please reach out:

We aim to respond to all privacy-related enquiries within 5 business days.