Privacy policy.

Annotated is a service of bytetalk.ai, which is provided by 1F2T LLC. Annotated includes the website at annotated.bytetalk.ai (the “Site”), the Annotated browser extension, and the Annotated mobile podcast application. This policy explains how we handle your information across the Service.

Questions: email privacy@bytetalk.ai.

We collect only what we need to run the service. There is no advertising, no third-party analytics, no data brokers.

From sign-in (Apple, Google, or X / Twitter)

When you sign in, the identity provider may send us:

• your name (display name), when you choose to share it
• your email address, which may be an Apple private relay address if you choose Hide My Email
• your avatar / profile picture URL, when the provider offers one
• a stable provider-issued user ID (so we recognize you on return visits)

We never receive your password. We do not request access to your contacts, Gmail, Drive, Calendar, tweets, DMs, or any other account data.

For Sign in with Apple, we keep Apple’s provider refresh token only so we can revoke the authorization grant when you delete your Annotated account.

Content you create

• annotations you publish (the source URL you annotated, its title, author, and thumbnail; any text you highlight; your written commentary)
• audio commentary you record, plus an automated transcript
• short video clips you capture from a source page (with an automated transcript)
• short podcast excerpts corresponding to fixed-duration moments you save while signed in, plus an automated transcript; the excerpt is fetched from the publisher’s enclosure URL by the Service and is never the full episode file
• comments you post and votes you cast
• users you follow
• optional profile fields you fill in: handle, display name, bio, and a profile photo you choose to upload

In the mobile app, quick bookmarks are private. Clips and notes can also be saved privately; publishing requires a separate, explicitly labeled action and confirmation. You can delete your annotations at any time. Audio commentary and video-clip creation are features of the Site or browser extension; the iOS app does not request microphone or camera access and does not record audio or video.

Podcast listening and mobile app data

• podcasts you subscribe to and your queue order
• episode playback position and completion state used for cross-device resume; listening-time totals and playback preferences remain on your device
• timestamped bookmarks, private notes, public annotations, and the podcast episode metadata needed to sync them
• a device identifier, refresh-token record, and optional push notification token used to keep your devices signed in and deliver notifications you enable

Downloaded podcast audio, the offline catalog, and local diagnostics are stored on your device. Podcast audio is delivered by the publisher’s hosting provider; we do not upload your downloaded episode files to Annotated. When a signed-in bookmark identifies a fixed-duration moment, the Service may fetch and store only that selected excerpt (up to 90 seconds) so the synced moment is playable and can receive a transcript. We do not re-host the publisher’s full audio file.

In the iOS app, when you search the public podcast directory, the search term is sent directly to Apple’s public iTunes Search API without your Annotated account ID. Searches of your downloaded library and cached transcripts stay on your device.

What the Extension accesses

The Annotated browser extension runs on sites for which you grant it access. Its content script locally detects the current page so the side panel is ready if you choose to use it. It reads:

• the current page’s URL and title
• public Open Graph metadata (e.g. og:title, og:image, author)
• audio and video elements on the page (to detect clip-able media and offer playback / clipping)
• text you select on the page, which is cached in the extension’s browser-session storage so it is ready if you choose the floating “Annotate” button or open the extension

Page details and selected text are not sent to Annotated’s servers unless you choose to create or publish an annotation. If you open the side panel on a Spotify episode, the extension may send that episode’s title and show name to Apple’s public iTunes Search API to look for an Apple Podcasts alternative. The extension does not read or transmit your browsing history, cookies, form inputs, passwords, or page content beyond what is described above. You can limit or revoke its site access in your browser’s extension settings.

Technical data

• standard request and security records (IP address, user-agent, request path, timestamp), used for security and abuse prevention
• short-lived access tokens and rotating refresh tokens we issue to keep you signed in (refresh tokens are stored hashed)
• rate-limit counters keyed to your account or IP
• app version, device platform, and redacted diagnostic events you choose to copy or share for support; the app does not include a third-party advertising or cross-app tracking SDK

• to authenticate you and keep you signed in
• to sync subscriptions, queue state, bookmarks, listening progress, and followed-show settings across your devices
• to deliver new-episode and guide-ready notifications when you enable them
• to display your annotations, profile, and activity to other users (per your visibility settings)
• to screen text proposed for public annotations, comments, and profiles for objectionable material; private bookmarks and private notes are not sent for public-content moderation
• to generate automated transcripts of audio and video clips you create, and short podcast excerpts for synced saved moments (so they’re searchable and accessible)
• to generate optional AI-written summaries and counter-arguments (“steelmans”) of annotations you publish
• to operate, secure, and debug the service (rate limiting, fraud prevention, error diagnosis)
• to respond to legal claims (e.g. fair-use disputes — see our public transparency report)

We do not sell your data. We do not share it with advertisers or data brokers. We do not use it to train AI models that we distribute.

To run Annotated we rely on a small number of vendors who process data on our behalf. We only send them the minimum needed for each task, subject to their applicable service terms and our service arrangements. The categories are:

• Identity providers for sign-in. You can choose Apple, Google, or X (Twitter). They return a stable account identifier and may return a name, email, or avatar depending on the provider and what you choose to share. We do not request access to unrelated account data.
• Cloud infrastructure — hosting, compute, database, file storage, and request routing. Your account data, annotations, audio recordings, short saved podcast excerpts, and video clips are stored here.
• Push notification delivery — receives an app installation token and notification payload so notifications you enable can reach your device.
• Email delivery — receives a recipient address and the message content when we send a required account, copyright-claim, safety, or support communication.
• Speech-to-text transcription — receives audio you record or the short podcast excerpt corresponding to a synced saved moment so it can return a text transcript. Audio is sent for processing only; we do not authorize the provider to retain it for training.
• AI text generation and safety screening (Anthropic) — receives the transcript, selected text, and source title of an annotation to generate optional summaries and counter-arguments. It also receives only the text proposed for a public annotation, comment, or profile when screening that text for objectionable material. When you upload a profile photo, it also receives that prepared still image for a safety check before we display it publicly. When you attach a screenshot of an X post from the browser extension, it receives that screenshot and its caption for the same safety check before the screenshot is published. This applies to photos and optional avatar illustrations alike. We do not send previous profile images automatically or send your account name, email, or identity with that image check. The check assesses image content and visible text; it is not used to identify people. Choosing a photo in Settings starts its upload and this safety check right away. Private bookmarks and private notes are not sent for that screening. Per the provider’s API terms, this content is not used to train their models.

Photo checks can be mistaken or unavailable. If a check cannot complete, the new image is not published and your current photo stays in place. You can retry or choose a different image. Public profile photos can also be reported for human review and removed under our community rules.

We will share the current list of named sub-processors on request (email privacy@bytetalk.ai) and will update this policy if we materially change the categories above.

We do not use Google Analytics, Meta Pixel, or any advertising or third-party analytics SDK.

Your data is stored on globally distributed cloud infrastructure and may be processed in any region where our service providers operate. By using Annotated, you consent to your data being transferred to and processed in the United States and other countries.

• Account data: kept while your account is active.
• Annotations and uploaded files: kept until you delete them or your account.
• Subscriptions, queue, and playback progress: kept while your account is active or until you delete your account.
• Push tokens: kept until you sign out, disable the device, or delete your account.
• API tokens: expire automatically; we store only a hashed value.
• Apple authorization token: kept while your Apple identity is linked so it can be revoked. When it is replaced or you delete your account, it is kept only in a restricted retry queue until Apple confirms revocation, then deleted.
• Reported profile photos: an uploaded photo may be retained for private moderator review after you replace or remove it. Removed photos are blocked from public retrieval. Once all open reports for that image are closed, the retained image is deleted unless it is still your current profile photo. Deleting your account removes these reports and queues retained photos for deletion. Temporary storage failures are retried.
• Security and abuse-prevention records: kept as needed to protect the service and investigate abuse. Account-linked records are removed with account deletion; anonymous records may be kept longer when needed for those purposes.
• Claims (DMCA / fair-use): retained as long as needed to comply with our legal obligations and show our public transparency report.

Deletion removes data from active systems. Residual copies may remain temporarily in service-provider backups until their normal retention cycles expire; those copies are not used for ordinary product operation.

You can, at any time:

• edit or delete individual annotations from your profile
• update your handle, display name, bio, or avatar in Settings
• request a copy of the personal data we hold about you, or its deletion, by emailing privacy@bytetalk.ai
• delete your account and associated server data directly from Settings in the mobile app or at /account/delete; if you signed in with Apple, deletion queues and attempts revocation of the Apple authorization grant, retrying temporary failures automatically
• revoke the Extension’s permissions from your browser’s extension settings at any time

If you are in the EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA, including the right to access, correct, port, or delete your data, and to object to certain processing. To exercise these rights, contact us at privacy@bytetalk.ai.

Annotated is not directed to children under 13, or below the minimum age required in their country. We do not knowingly collect personal information from children below that age. If we learn that we have done so, we will delete it. If you believe a child below the applicable minimum age has provided us their information, email us. Minors who meet the minimum age may use Annotated only with a parent or legal guardian's permission.

We use industry-standard measures to protect your data — encrypted transport (HTTPS), hashed API tokens, scoped OAuth permissions, and least-privilege access to production systems. No method of transmission or storage is 100% secure; if we learn of a breach affecting your data, we will notify you as required by law.

If we make material changes to how we handle your data, we’ll update the effective date above and, where appropriate, notify you in-app or by email before the changes take effect.

For privacy questions, data requests, or anything else, email privacy@bytetalk.ai.