AppNotes separates private browser notes from connected organization data. The mode is explicit, and a JavaScript download alone never activates the tool.
Local mode
- No AppNotes account or backend is required.
- Notes and their images stay in the current browser.
- The SDK does not contact the AppNotes service or identify a user.
- Signing in or enabling connected mode does not upload local notes.
Automatic capture can load packaged SDK assets and fetch page fonts or images again. These requests follow CSP and CORS. Local mode does not upload the resulting image. Disable capture when you do not want this behavior.
Connected mode
- Each Site is bound to one exact origin.
- Launch credentials are short-lived and carried in the URL fragment, not the query string.
- The SDK strips the launch fragment before its first request and confines it to the browser session.
- Screenshots are private objects owned by a note.
- Team members can access their Organization’s Sites according to their role and plan. Guest review sessions are limited to one Site.
Exclude private content
AppNotes omits form controls, editable content, and explicitly private regions from captured element text, HTML context, and automatic images. The image also excludes the AppNotes interface itself. A selection inside a private region does not produce an automatic image.
Mark sensitive content with data-appnotes-private or data-private:
<section data-appnotes-private>
Customer account details
</section>The exclusion applies to that element and its descendants. Surrounding layout can remain visible. These markers do not delete information from existing notes or images.
AppNotes cannot identify every secret in ordinary page text or images. Mark sensitive regions before review begins. Inspect the image preview and comment before saving. Do not type secrets into a comment.
Capture stays within the visible viewport and does not reveal hidden or offscreen content. Images can include nearby visible content around a selected target. Use Remove image when that context should not be shared.
Setting capture: "off" disables images, not element-context collection. Continue to mark private regions when capture is off.
Agents
Organization API keys are bearer credentials. Their plaintext is shown only once. Store them in the agent’s secret manager, scope one key to one integration or job, and revoke them when no longer needed.
Do not put an API key in client-side code, a repository, a copied prompt, or a Site launch URL.
Guest links
A guest link grants view and comment access to one Site without team membership. It does not grant access to other Sites or team administration. Anyone who has an active link can use that Site-scoped access until the link expires or is revoked.
Create separate guest links when separate revocation or expiry boundaries are useful, for example one link per client engagement.
Self-hosted data
In the portable profile, your organization owns the SQLite database, screenshot filesystem, OIDC configuration, backups, network controls, and retention policy. Hosted billing configuration is not loaded in that runtime.