Privacy Policy

Last updated: April 21, 2026

StepShot is a browser extension and web app that captures workflows you choose to record and turns them into step-by-step guides. This policy explains what we collect, where it's stored, and how you stay in control.

What we collect

• Account details — the email address and password you use to sign up. Passwords are hashed with bcrypt; we never see or store your plaintext password.
• Recordings you create— when you click “Record” in the extension, we capture screenshots of the visible browser tab, the URL and page title of each step, the text label or name of the element you clicked, and any text you typed into non-password fields (truncated to 200 characters). Recording stops when you tell it to.
• Annotations and edits — the titles, descriptions, notes, and annotation positions you add in the editor.

What we do NOT collect

• We do not record keystrokes or clicks on pages you are not actively recording.
• We do not capture the contents of password fields. Ever.
• We do not read or transmit your browsing history.
• We do not sell or share your data with third parties for advertising.

Where it's stored

• Locally in your browser— recordings live in the extension's IndexedDB (via Dexie) until you choose to publish them. You can delete them any time from the extension side panel.
• On our servers, only when you publish— clicking “Publish” uploads screenshots to Cloudflare R2 and saves the guide metadata to our PostgreSQL database. Both are hosted in regions operated by Cloudflare and a commercial VPS provider, respectively.

Who can see your guides

Published guides are private to you by default. No one else can view them unless you explicitly turn on a public share link from the guide's page. Public links are long, random, and unlisted — we don't publish a directory of public guides, androbotsheaders ask search engines not to index them, though we can't control every crawler.

Your control

• Delete any guide from the dashboard. Deletion removes the database record and the associated screenshots from R2.
• Toggle a public share link off and the public URL returns a 404 immediately.
• Email nistre@gmail.com to request full account deletion; we'll erase your account and every guide tied to it.

Permissions the extension uses

• activeTab + tabs— capture screenshots of the tab you're recording.
• <all_urls> host permission — you record on any site you choose, so the content script needs to run on the site you pick. It activates only during an active recording session.
• storage + unlimitedStorage — keep your recordings in local IndexedDB before publish.
• scripting — inject the click-capture content script.
• sidePanel — our primary UI.

Children

StepShot is not directed to children under 13, and we do not knowingly collect information from them.

Changes

We may update this policy as the product evolves. The date at the top tells you when it last changed.

Contact

Questions, concerns, or deletion requests: nistre@gmail.com.