Privacy

Two different things live here, and they behave differently. The distinction matters, so it is spelled out rather than summarised.

The Tack library

The script you install on your own site sends nothing anywhere. It makes no network requests of any kind: no telemetry, no version check, no error reporting, no analytics. Your annotations are never transmitted.

Everything it stores is in your own browser:

• localStorage["tack_notes"] — your notes for the current origin
• localStorage["tack_last"] — the last export, so it can be restored
• localStorage["tack_prefs"] — toolbar settings

Clearing site data removes all of it. A review link carries its contents inside the URL fragment, which browsers do not send to servers — it travels only as far as you paste it.

What the page you are annotating can see

The fragment not reaching a server is not the same as nobody being able to read it. Tack runs inside the page, so that page's own JavaScript can read location.hash before Tack clears it, and can read localStorage because Tack stores notes under the page's own origin. A site could therefore read a review you opened on it, or notes you left on it earlier.

On your own site and on your local development server this is not a threat — it is your code either way. It matters when you use the bookmarklet on a site you do not control and do not trust: treat anything you type there as visible to that site. If a note must stay private, write it somewhere else.

Loading the script from unpkg.com is a request to that CDN, the same as any third-party script tag — and that includes the bookmarklet, which fetches the script from there before anything else happens. The library makes no requests once it has loaded. Self-host the file if you would rather not make that one.

The source is MIT licensed and about 900 readable lines; none of the above requires taking our word for it.

This website

gettack.dev uses Vercel Web Analytics to count visits, so we can tell whether anyone is finding the project. It records page views, referrer, country, device type, browser and operating system, and derives a daily visitor hash from the request. It does not use tracking cookies and does not build a cross-site profile of you.

A handful of interactions are counted as events, without any content attached: activating the demo, copying the install snippet, taking the bookmarklet, following a link out to GitHub or npm, and — reported by the library as plain browser events, never over the network — saving a note, copying an export, producing a review link, and running the applied check. Counts only; never note text, selectors or page content.

Automated browsers are not counted. Anything reporting navigator.webdriver — our own test and recording runs, and most scrapers — is dropped before it is sent.

Review links are never reported. If you open a #tack=… link on this site, the fragment stays in your browser and is stripped from anything analytics sees.

Fonts are served from this domain, so viewing this page does not contact Google or any other third party. The only external request is to unpkg if you install the script from there.

Contact

Questions or corrections: open an issue.