Privacy Policy

• Local mode keeps data on your device. Recordings and captured page data are not transmitted to us unless you choose to upload or share them.
• We redact credentials before storing or uploading. The extension strips passwords, tokens, and authorization codes from captured network and page data.
• We do not sell your personal information.
• You can delete your recordings, revoke share links, and request deletion of your account data.

We collect the following categories of information:

• Account information — your email address and the API key associated with your account, plus any profile details you provide.
• Payment information — handled by our payment processor (Stripe). We receive limited billing details (such as plan, status, and the last four digits of a card); we do not store full card numbers.
• Recordings and captured content — when you record a session and choose to upload or share it, we receive the video, optional microphone audio, screenshots, transcripts, and structured activity (clicks, console logs, network requests, navigation). In local mode this stays on your device.
• Usage and analytics data — on our websites and app we use analytics (PostHog) and may log product events to understand and improve the Service.
• Device and log data — IP address, browser/OS type, and diagnostic logs generated when you use the Service.

By design, the extension redacts credential-bearing data from structured captures — network requests, page metadata, console logs, and action logs — including passwords, API keys, bearer/basic auth, JWTs, OAuth authorization codes, and URL credentials, before that data is stored in memory or uploaded.

This redaction does not apply to the screen recording itself: video and screenshots capture whatever is visible on screen, and optional microphone audio captures whatever is spoken. Credentials shown on screen or read aloud during a recording may therefore appear in the recording. Pause or avoid recording sensitive screens, and don't read secrets aloud while recording.

We use information to:

• provide, operate, secure, and maintain the Service;
• generate the AI analysis you request and deliver shared recordings to the recipients you choose;
• process payments and manage subscriptions;
• detect, prevent, and address fraud, abuse, and security issues;
• analyze usage and improve features and reliability; and
• communicate with you about your account, updates, and support.

When you invoke AI features or upload content to the cloud, your recordings and related content are processed by third-party AI model providers, routed through our model gateway, to produce analysis. We use providers under agreements intended to protect your content; we do not use your content to train third-party foundation models except as permitted by you or required to provide the feature you requested.

We share information only as follows:

• At your direction — when you create a share link, recipients with the link can access that recording (subject to any password or access controls you set).
• Service providers — vendors that help us run the Service, including payment processing (Stripe), cloud storage and compute (Cloudflare R2, Fly.io), analytics (PostHog), and AI model providers, each bound to handle data on our behalf.
• Legal and safety — when required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal information and do not share it for cross-context behavioral advertising.

We retain account information for as long as your account is active and as needed to provide the Service. Uploaded recordings and their derivatives are retained until you delete them or close your account; deletion may not be immediate across backups. We may retain limited information as required for legal, tax, security, or fraud-prevention purposes.

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can delete recordings and revoke share links in-product, and request account deletion or exercise other rights by contacting us at [email protected]. We will not discriminate against you for exercising these rights. If you are in the EEA/UK or California, additional rights under the GDPR or CCPA/CPRA may apply.

Our websites and app use cookies and similar technologies for authentication, preferences, and analytics (including PostHog). You can control cookies through your browser settings; disabling some may affect functionality.

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and the credential redaction described above. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

We operate in the United States, and your information may be processed in the U.S. and other countries where we or our service providers operate. Where required, we use appropriate safeguards for cross-border transfers.

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by updating the date above or by reasonable electronic notice). Your continued use of the Service after changes take effect constitutes acceptance.

Questions or requests about this Policy or your data? Contact us at [email protected] or through your ThinkRun account. Derivative Labs, LLC.