ZhuzhUp

Privacy Policy

Last updated August 3, 2026

ZhuzhUp is a Chrome extension that lets you leave comments and make hands-on visual edits on any website, then turn that feedback into a brief for an AI coding agent or developer. This policy explains what we collect, why, and what we do not do.

The short version: you can use ZhuzhUp without an account, and if you do, nothing you write ever leaves your computer. Signing in is what turns on syncing, and from then on your notes are stored with us so they follow you between devices. We do not sell anything, we do not run ad trackers, and we do not train models on your work.

What we collect

• Your email address, when you choose to sign in. We use it only to send your sign-in code and to identify your account.
• The comments and edits you create, when you are signed in and cloud sync is active. A comment includes the text you write, your chosen display name, the address (URL) of the page it is on, a CSS selector identifying the element you pinned, and a short snapshot of that element (its size, fonts, colors, and nearby text) so the change can be reproduced. Move, resize, and text-size edits store the numeric change you made.
• Usage counts, specifically the number of times you compile a brief each month, so we can see how ZhuzhUp is actually being used. There is no limit on the free plan today.
• Whether a brief led to a change you kept. Each time you compile a brief we record which of your notes went into it and how big it was, and we give it a short code. If you later mark a note done, or un-mark it, we record that too. This is how we tell whether the briefs ZhuzhUp writes are any good, and it is the only way the tool improves.
• Waitlist email addresses, when you sign up on our website.
• An install count. When you install or update the extension, it sends a random ID generated on your device, the version number, and whether it was a new install or an update. It contains no web address, no page content, and nothing you have written. We use it to know how many people are using ZhuzhUp.
• A download count, if you download the extension from our website rather than installing it from the Chrome Web Store. We record that a download happened, along with the page that referred you and your browser type. That row holds no IP address and no identifier, so it cannot be traced back to you on its own.
• A link between your email address and your copy of the extension — only if you download it directly from us. This one depends entirely on how you got ZhuzhUp, so it is worth being exact about:
  • Installed from the Chrome Web Store: there is no such link, and we cannot create one. We never learn your email address from an install, and your install is one anonymous row in a counter. If you later sign in, your account exists on its own with nothing joining it to how you arrived.
  • Downloaded from our website, or from a personal invite link we sent you: when you give us your email on the download page, or use an invite link, we create a code and hold your email next to it. That code is recorded with your download and placed inside your copy of the extension, so that when you install it we can tell it was you. If you later sign in with the same address, we can connect your download to your account. In plain terms: we can see that you downloaded it, whether you installed it, and whether you went on to use it. We do this so we know who is actually trying it and can follow up with them.
  Nothing here is derived from your device, your network, or your browsing, and none of it is used for advertising. Ask us and we will delete it.
• A short-lived record of your network address for abuse prevention. When you download the extension or submit a form, we hold a scrambled, one-way version of your IP address for a limited time, purely to stop one person from making thousands of automated requests. We cannot recover your IP address from it, it is not stored with your download or your account, and it is not used to identify you.
• Website analytics, and the cookie choice you are offered. Our website uses Google Analytics to count visits and see which pages people land on, so we know whether anyone is finding ZhuzhUp. What it does depends on the choice you make in the banner:
  • Until you choose, and if you decline: it runs with storage switched off. No cookie is set and nothing is stored on your device, so a later visit is not linked to an earlier one.
  • If you allow it: Google Analytics sets its usual cookies (_ga and one named for our property) so that a repeat visit can be recognised as the same browser.
  Either way, loading it means your browser contacts Google's servers, so Google receives your IP address and the address of the page you are on, and may use the IP to estimate a rough location. Advertising personalisation is switched off in both cases, so none of it feeds ad targeting. Your choice is remembered in your browser's local storage so you are not asked twice; clearing your browsing data resets it and you will be asked again. This runs on the website only. There is no analytics of any kind inside the extension.

What we do not do

• We do not sell your data, ever.
• We do not use your comments or page content to train AI models.
• We do not track your browsing. ZhuzhUp is able to run on any site — that is what lets you click the toolbar icon anywhere and start leaving notes — but being able to run somewhere is not the same as reading it. It reads a page's content only when you actively turn comment mode on, and only to place your notes and edits. The single exception is that it checks the page address for a shared-notes link, which is described under Shared links; that check looks at the address only, never the page.
• We do not run advertising trackers, and the extension does not report the sites you visit. The only thing it sends on its own is the install count described above. Note that a comment you save while signed in does include the address of the page you pinned it to, because that is what makes the comment mean anything, so pages you comment on while signed in are visible to us in your own synced notes.

Where your data lives

Your account, comments, and usage counts are stored in our database hosted on Supabase (Amazon Web Services, United States). Access is restricted by row-level security so that you can only read and write your own data. Until you sign in, everything you create stays only on your own device in the browser's local storage.

Shared links

When you create a share link, the comments in it are encoded into the link itself. Anyone you send that link to can see those comments. You control who receives it.

Going the other way — when you open a link someone sent you — nothing is added to your notes until you say so. ZhuzhUp notices that the address carries shared notes and puts a count on its toolbar icon. Nothing is saved, nothing appears on the page, and comment mode does not switch itself on. You click the toolbar icon, see how many notes the link is offering, and choose Import or Discard. If you discard them, they are gone.

Notes that arrive this way stay on your own device. They are never uploaded to your synced account, because a link somebody sent you should not be able to write into your account. They are also always attached to the page you are actually on, so a link cannot plant notes against some other website you might visit later.

Signing in

Sign-in happens in a separate ZhuzhUp window, not on the website you are looking at. Your email address and the one-time code you receive are typed into a page that belongs to the extension itself, which the site you were on cannot read. The site never sees your address, your code, or the fact that you signed in.

The brief you generate

When you click to compile a brief, ZhuzhUp assembles your notes into text and copies it to your clipboard. You decide where that text goes next, for example into your own AI coding tool or to your developer. ZhuzhUp does not send it anywhere on its own.

Your choices

You can use ZhuzhUp without signing in, in which case nothing leaves your device. You can sign out at any time. To delete your account and all associated data, email us at the address below and we will remove it.

Children

ZhuzhUp is not directed to children under 13 and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date above and, for material changes, notify signed-in users by email.

Contact

Questions or data requests: hello@zhuzhup.ai.

← Back to ZhuzhUp