Chrome Web Store Compliant Policy

Privacy Policy for SideNote

Effective Date: October 8, 2026 • Document Version: 1.0.0 • Applies to: SideNote Chrome Extension (MV3) & Related Services

1. Executive Summary & Core Principle

At SideNote ("we", "our", or "us"), we believe that your notes, thoughts, reading habits, and voice memos belong exclusively to you. SideNote is engineered as a Local-First Chrome Extension.

The Core Privacy Guarantee:

We do NOT collect, harvest, sell, or monetize your personal data.
Your notes and voice recordings are stored strictly on your local device.
We do NOT use external analytics trackers, ad networks, or telemetry SDKs.
We strictly adhere to the Google Chrome Web Store Developer Program Policies and the Limited Use Requirements.

2. Single Purpose Statement (Chrome Web Store Requirement)

In compliance with the Chrome Web Store Quality Guidelines, SideNote has a clear, singular purpose:

"SideNote provides contextual note-taking and voice memo recording directly within Google Chrome's native side panel."

All requested browser permissions, APIs, content scripts, and background operations exist solely to fulfill this single stated purpose.

3. Itemized Permissions & Technical Justifications

Below is the exhaustive declaration of every permission requested in the SideNote extension manifest (manifest.json) along with the narrow technical justification for each:

Permission	API Role	Specific Justification
sidePanel	UI Container	Allows SideNote to display the notes list, rich text editor, and audio player in Google Chrome's native side panel. This prevents intrusive floating popups and keeps your active webpage undisturbed.
storage	Local Database	Used to store note text, page URLs, page titles, color choices, and voice recordings on your computer via `chrome.storage.local`.
unlimitedStorage	Quota Exemption	The default `chrome.storage.local` quota is capped at 10 MB. Because voice memos and image attachments are stored locally as audio/image data URLs, this permission prevents data write failures when your personal notes collection expands.
tabs	Tab Metadata	Used strictly to inspect the active tab's URL and title in order to associate notes with the current website (e.g. `github.com`), and to detect restricted browser protocols (`chrome://`, `edge://`) where the side panel is safely disabled. We do NOT log, monitor, or track your browsing history.
identity	Google OAuth2	Used strictly when you optionally choose to sign in with Google in the extension. Enables verifying user identity, displaying your profile avatar in the navigation bar, and automatically linking Polar Pro or Lifetime subscription entitlements. Never accesses Gmail, Drive, or contacts.
alarms	Task Scheduler	Used to run scheduled lightweight cleanup routines and periodic entitlement synchronization without keeping the background service worker persistently active in memory.
Microphone (Web Audio)	Device Sensor	Requested via browser prompt (`navigator.mediaDevices.getUserMedia`) strictly when you click the microphone record button in the sidepanel or test it in Settings. It is NEVER recorded in the background, NEVER recorded without manual interaction, and audio is NEVER sent to remote servers.

4. Data Collection, Handling, and Storage

SideNote categorizes data processed during normal operation as follows:

Data You Author Directly

Note text and rich formatting (TipTap HTML)
Audio voice memos recorded via your microphone
Cover images or card image attachments
Pinned status and Google Keep color selections

Contextual Association Data

Canonical webpage URL where note was created
Website hostname (used as storage partition key)
Page title (used as default note title)
Creation and modification timestamps (epoch ms)
User preference configurations (audio quality, defaults)

Optional Identity & Subscription Data

Google Profile (Optional): If you choose to sign in, your display name, email address, and avatar image URL are used strictly for user identification and profile menu rendering.
Subscription Entitlement: Verification metadata (such as isPro, license state, or subscription identifier) is cached in chrome.storage.local to unlock Pro exports and backups.
Payment Card Data: Processed exclusively by Polar (polar.sh). SideNote never collects, handles, or stores credit cards or financial accounts.

Where is this data stored?

100% of your notes and audio recordings are stored exclusively in your browser profile directory using chrome.storage.local. It is partitioned by hostname (for example: { "github.com": [Note, Note] }). It is never sent to our servers, never synchronized without your knowledge, and never shared with third parties.

5. Chrome Web Store Limited Use Disclosure

SideNote complies fully with the Google Chrome Web Store Limited Use Policy regarding the collection and use of data obtained through Chrome APIs:

1. No Sale of User Data: SideNote will not transfer or sell user data to third parties, including advertising platforms, data brokers, or information resellers under any circumstances.

2. No Advertising or Retargeting: User data will not be used or transferred for serving personalized, retargeted, or interest-based advertisements.

3. No Creditworthiness Determination: User data will not be used or transferred for assessing creditworthiness, lending, or financial scoring.

4. Human Access Prohibition: No human (including SideNote developers or contractors) can read your notes or recordings, as they reside purely within your personal local browser storage.

6. Manifest V3 Security & Zero Remote Code Execution

In accordance with Google Chrome Manifest V3 security requirements:

Zero Remote Code: SideNote contains no dynamically loaded scripts, external CDN bundles, or remote code evaluation (eval(), new Function()). All JavaScript, stylesheets, fonts, and icons are bundled locally in the extension package.
Isolated Extension Context: SideNote runs entirely within Chrome's native extension security sandbox. Host websites cannot inspect, alter, or access your notes or audio memos.
Content Security Policy (CSP): All extension pages enforce strict CSP headers, preventing unauthorized outbound connections or script injections.

7. Monetization, Subscriptions & Polar Billing

SideNote provides a generous, fully-functional free tier for local note-taking alongside optional premium tiers (Pro Monthly, Pro Annual, Lifetime License) for advanced export and backup tools:

Secure Merchant of Record: All subscription and lifetime payments are processed by Polar (polar.sh), our compliant payment infrastructure provider. Polar handles card encryption, tax compliance, and billing management.
Zero Financial Data Stored by SideNote: We do NOT collect, process, or store credit card numbers, CVVs, expiration dates, or bank routing details. All sensitive financial transactions occur securely within Polar's PCI-DSS compliant checkout session.
Optional Google Sign-In: Registering or signing in with Google is completely optional. You can use SideNote offline and anonymously without an account. Signing in is only utilized to associate your Pro subscription and customer portal across devices.
No Advertising or Data Monetization: We never sell your personal data, monetize browsing habits, inject sponsored notes, or serve third-party ads.

8. User Rights & Complete Data Erasure

You maintain complete sovereignty over your data at all times:

• Individual Note Deletion: You can delete any note or voice memo with one click directly in the sidepanel or All-Notes dashboard.

• Complete Data Erasure: Click Clear All Notes & Data in Settings to instantly wipe all extension data from chrome.storage.local.

• Subscription & Billing Cancellation: If you subscribed to Pro, you can manage billing methods, retrieve receipts, or cancel future renewals at any time directly through the Polar Customer Portal accessible from the extension user menu.

• Uninstallation: Removing the SideNote extension from Chrome immediately and irreversibly deletes all locally cached extension data from your browser profile.

9. Children's Privacy (COPPA Compliance)

SideNote is not designed for, targeted toward, or intended for use by children under the age of 13. We do not knowingly collect or solicit any personal information from children under 13. Because SideNote does not collect personal data, no child's personal data is ever stored on external servers.

10. International Privacy Rights (GDPR & CCPA/CPRA)

Under the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA):

Right to Know / Access: You can inspect all data stored by SideNote at any time via the Settings analytics panel or directly within Chrome's local storage inspector.
Right to Rectification & Erasure: You can edit or purge your data immediately without submitting a support request.
"Do Not Sell My Personal Information": We do not sell or share personal data. Therefore, an opt-out mechanism is unnecessary as no selling occurs.

11. Changes and Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect product enhancements, architectural updates, or regulatory adjustments. If we make material changes affecting how data is handled, we will post the revised policy on this website with an updated Effective Date and provide an in-extension notification where appropriate. Continued use of SideNote following any update constitutes acceptance of the revised policy.

12. Contact & Data Protection Inquiries

If you have any questions, concerns, or inquiries regarding this Privacy Policy, our data handling practices, or our Chrome Web Store compliance, please contact us:

Entity: SideNote Extension Core Team

Email: privacy@sidenote.app / support@sidenote.app

Source Repository: GitHub - SideNote Chrome Extension