Device first
Uploaded files initially live only in your device's browser storage (IndexedDB). Without sharing or cloud sync, nothing is transmitted to a server – no preview, no thumbnail.
Servers in the EU
Shared files, comments and accounts are stored with Supabase in the European Union. Encrypted in transit (TLS 1.2+) and at rest (AES-256).
JavaScript in a sandbox
HTML files run in an isolated frame (iframe sandbox) on their own origin. Scripts inside the file cannot access your library, your account or other files. Network access is blocked by default and must be allowed per file.
You control access
Every link is a random, unguessable address. Optional: password (stored as a bcrypt hash), expiry date, role (view / comment / edit), revocable at any time. Shared pages are blocked for search engines (noindex) and never listed anywhere.
No cookies, no tracking
Annopane sets no tracking cookies and no ad pixels. Sign-in uses a token in your browser's local storage. Views of shared links are counted without storing IP addresses or personal data.
Deletion is final
Guest links expire after 7 days and are deleted together with their files. You can delete your account yourself in Settings – all cloud files, links and comments disappear immediately and irreversibly (GDPR Art. 17).
What is stored where
Device mode (default): files, versions, comments and thumbnails live exclusively in your device's browser. They are not synced and disappear if you clear site data.
Cloud mode (with account): files and comments are stored in the Supabase database in the EU and synced to your signed-in devices. Access is restricted via row-level security to you and the people you grant rights to.
Guest links (no account): the file is transmitted encrypted, stored for 7 days and then deleted automatically. The creator can delete the link earlier at any time.
How shared HTML files are executed
An HTML file may contain JavaScript – intentionally, because interactive calculators and dashboards need it. Annopane runs the file in a sandboxed iframe: no access to the app's cookies or storage, no access to other files, and no network unless you allow it per file.
Recipients cannot modify the file. Comments are stored outside the file and shown at the same spot the next time it is opened.
Accounts and sign-in
Sign-in works via a one-time code sent by email – no password needed. Company workspaces recognise members by email domain; admins see members, roles and usage – never the content of other people's files.
Access tokens for the Claude connector (MCP) are stored as hashes and can be revoked in Settings at any time.
Operations and availability
The app is delivered via Lovable (frontend hosting, CDN); database and files are hosted by Supabase in the EU with daily backups. Security headers (HSTS, nosniff, Referrer-Policy, frame-ancestors) are in place.
Annopane is a young product in beta. There is no SOC 2 or ISO 27001 certification yet. For enterprise customers we provide a data processing agreement (DPA) and a technical description on request.
Reporting a vulnerability
If you find a vulnerability, please write to hello@annopane.com. We reply within two business days, fix confirmed issues with priority and credit you as the finder if you wish.
Subprocessors
Providers that process data on our behalf.
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, edge functions | European Union |
| Lovable Labs Inc. | Hosting and delivery of the web app (CDN) | EU/USA (CDN nodes worldwide; no user files) |
| Amazon Web Services EMEA SARL | Infrastructure underneath Supabase | European Union |
Frequently asked questions
Can Annopane read my files?
In device mode no – they live only in your browser. In cloud mode they are in our database; technically the operator has infrastructure access, but we only open files at your explicit request, e.g. in a support case.
Can a recipient forward my file?
The link, yes, unless you restrict it with a password or expiry. You see in the view statistics how often it was opened and can delete the link at any time.
Are my files used for AI training?
No. Neither Annopane nor our providers use content to train models. The Claude connector only transmits what you request yourself.
Is there a DPA?
Yes, for enterprise customers on request at hello@annopane.com.
What happens during an outage?
Files in device mode remain usable offline. Cloud files are available again after recovery; Supabase keeps daily backups.
Read on
Related pages