Privacy Policy

Last updated: 2026-07-15

Your datasets, media and annotations stay on your device.

AnnotateIt is a local-first computer-vision annotation application. This policy describes the current production web, desktop and mobile applications. It distinguishes your project content from the limited network metadata generated when public web assets are delivered.

Your Project Content

Projects, imported images and videos, dataset archives, labels, annotations, settings and exports are stored on your device or in browser-managed local storage. The current production product does not provide cloud accounts, project sync or hosted dataset storage, and it does not upload project content to an AnnotateIt backend.

You control the lifecycle of this content. It remains until you delete the project, clear the application's storage, uninstall the application or otherwise remove it from your device. Browser and operating-system backup behaviour is controlled by your platform settings.

Local AI and Model Delivery

AI-assisted annotation runs on your device. Desktop and mobile builds bundle their model files. The web application may download ONNX models and a WASM runtime from models.annotateit.ai when a local AI feature needs them. The download identifies the requested model file and produces normal HTTPS request metadata, but it does not include your image pixels, prompts, labels or annotations.

Web Infrastructure Data

The web application is delivered through Cloudflare Pages, and model files are delivered through Cloudflare R2/CDN. The separate marketing website at www.annotateit.ai is currently hosted by Vercel. Like other Internet infrastructure providers, these services may process IP addresses, requested URLs, request headers, browser or device information, timestamps, and security or operational logs needed to deliver and protect the services.

The current production application does not enable advertising trackers or product telemetry. Web Vitals are not transmitted because no reporting endpoint is configured.

Support and Security Communications

If you email support, privacy or security contacts, we process the email address, message, headers and attachments you intentionally provide. Do not send private datasets or personal data unless they are necessary and an approved transfer method has been agreed.

Support requests are retained for up to 24 months after the last correspondence. Security reports may be retained for up to five years to document remediation and protect the service. Records may be kept longer where required by law or necessary to establish, exercise or defend legal claims.

Purposes and Legal Bases

Delivering the application and model files: performance of the service you request and legitimate interests in operating the product.
Security and abuse prevention: legitimate interests in protecting users, infrastructure and the service.
Responding to support, privacy and security messages: taking steps at your request, providing support and legitimate interests in maintaining the product.
Compliance records: compliance with legal obligations and establishment, exercise or defence of legal claims.

Infrastructure Providers and International Processing

Cloudflare, Vercel and email providers operate global infrastructure and may process request or communication data outside your country. Their roles, purposes, policy links and DPA links, including information about international-transfer safeguards, are listed on the Subprocessors page.

Your Choices and Rights

You can delete project content directly in the application or by clearing its local storage. Depending on applicable law, you may also request access, correction, deletion, restriction, portability or objection for personal data processed through support or infrastructure records. You may lodge a complaint with your local data-protection authority.

Children

AnnotateIt is designed for professional, educational and research workflows and is not directed to children. We do not knowingly request personal data from children.

Changes

This policy will be updated before introducing cloud sync, hosted project storage, accounts, product analytics, advertising, or any workflow that sends project content to a managed service.