Margin privacy policy.

In short.

Margin is a Chrome extension published by Lilac Fragment. Everything it saves stays on your computer. It has no account, no analytics and no tracking. It only sends a review out of your browser when you send it to Jira or Figma yourself, and then it goes straight to that service. Lilac Fragment never sees your reviews.

When Margin runs.

Margin only runs on a tab where you start it, from its toolbar button, its keyboard shortcut or the right-click menu. It has no permission to read other sites, apart from your Jira site if you press Find my site, and it does not read pages in the background.

What Margin saves.

Margin saves what you create in the browser's local storage for the extension, on your computer. That includes the following.

• Screenshots of the visible part of the page where you mark something.
• Your notes, severities and numbered markers.
• The address and title of the page each comment is from.
• The CSS selector of an element you pick, only when selector capture is on.
• Your Margin settings.
• Your Jira and Figma sign-ins and the connected account name and email, only if you connect them.

What Margin sends.

Nothing, unless you send a review to Jira or Figma. Margin makes no network requests of its own, and it has no analytics or tracking. Your data is never sold or shared.

The source code is public on GitHub under the MIT license, so anyone can check what Margin sends.

Sending to Jira and Figma.

When you send a review, only what you send leaves your browser, and it goes directly to the service you picked. What happens to it after that is covered by Atlassian's and Figma's own privacy policies.

• To Jira, Margin sends each comment's title, note, numbered notes, severity, page address, Figma links and screenshots, as new issues on the Jira site you choose.
• To Figma, Margin sends each comment's title, note, numbered notes, severity and page address, as a comment on the frame its Figma link points at.
• Jira's create form needs no sign-in. Margin opens it in a new tab with the title and text filled in, and nothing is sent until you press Create in Jira.

Signing in to Jira and Figma.

Connecting Jira or Figma is optional. When you connect one, its own sign-in page opens in a Chrome window, and you choose there what Margin may do. Margin keeps the sign-in tokens in the extension's local storage on your computer and uses them only to send what you ask it to send.

Atlassian and Figma only finish a sign-in for apps that prove a private secret, and a secret cannot be kept safe inside an extension. So one step of the sign-in goes through a small helper on lilacfragment.co.za that holds the secret. It swaps the one-time sign-in code for tokens and renews them when they run out, then passes them straight back to Margin. It does not store or log the tokens, and it never receives your reviews, screenshots or notes.

Like every website, our web host keeps a standard access log of the addresses it serves. A sign-in address includes the one-time code, which expires within minutes and is useless without the secret.

Copying and exporting.

Margin only writes to your clipboard when you click Copy for Docs, Copy as Markdown or Copy on a comment. Word, HTML, print and review file exports are files you save yourself, and you decide where they go and who gets them.

Deleting your data.

Delete a comment or a whole review in the report and Margin removes it from its storage. Disconnect a service under Connections in Help and settings and Margin deletes its tokens and gives back its permission. You can also remove Margin from your Atlassian or Figma account settings. Removing Margin from Chrome clears everything it saved, so save a review file first for any review you want to keep. Issues and comments you already sent stay in Jira and Figma, where you manage them.

Permissions.

Margin asks Chrome for seven permissions when you install it, each for one job. Three more are optional and only asked for when you use the feature that needs them.

• activeTab lets Margin take a screenshot of the tab you start it on, and only that tab.
• scripting adds the marking layer to that tab when you start Margin.
• storage keeps your reviews, settings and sign-ins on your computer.
• unlimitedStorage is needed because screenshots soon outgrow the browser's default storage limit.
• clipboardWrite lets the copy buttons put the review or a comment on your clipboard.
• contextMenus adds Margin to the right-click menu.
• identity opens the Jira or Figma sign-in window when you connect one.
• Access to api.atlassian.com is optional and asked for when you connect Jira, so Margin can create issues and attach screenshots.
• Access to api.figma.com is optional and asked for when you connect Figma, so Margin can post comments.
• Access to atlassian.net sites is optional and asked for when you press Find my site, so Margin can see which Jira site you have open and list its projects.

Future changes.

If we add other features that send data off your computer, such as team sharing or sync, we will update this policy and the Chrome Web Store listing before that version ships, and those features will say what they send.