Skip to main content

Security and privacy

Skeleton page

This page is a skeleton for now. A commitment is not published until its security gate is verified and legal review is done. The status labels below show that.

The data path

The five stations a recording passes through from start to end.

  1. Capture

    The extension only collects clicks, screenshots and (unless disabled) typed text when you start it.

  2. Upload

    Data goes to the server through signed links. If an upload is interrupted the on-device queue retries.

  3. Process

    Images are processed on the server. Sharing and export are designed to use redacted copies only.

  4. Store

    Raw images are kept for 7 days by default and the period is adjustable from 0 to 30 days. A value of 0 never keeps raw images.

  5. Delete

    Guides in the trash are deleted for good after 30 days. Account and workspace deletion and data export requests are planned to complete within 30 days.

Design rules

These are rules from the product specification. Each one will be marked "verified" once it passes its test gate.

  • The contents of password fields are not read or stored.Being verified
  • Sharing, export and public pages use redacted image copies only.Being verified
  • A workspace admin can switch AI processing off. While off, no request reaches the AI gateway.Being built
  • Your content is not used to train models.Planned

Data requests and KVKK

Personal data deletion and export requests, the privacy notice, the processor list and data region information will be published here after legal review.

Legal pages

Reporting a vulnerability

The reporting address will be added to this page before launch.