Privacy policy

Last updated: November 1, 2026

Bugcap is a Chrome extension that records bug reports, plus the website bugcap.io where you can share them as links. This policy explains what data each part handles, what we do with it, and the choices you have. If you have questions, email [email protected].

The Chrome extension

The extension captures nothing until you start a recording, and it stops capturing when the recording ends. A recording contains:

• Video of the browser tab you choose to record.
• Audio from your microphone, only while it's unmuted. The mic follows the "Record microphone" setting, which is on by default, and you can mute it at any time while recording.
• Notes you add to a drawing or a marked moment. When the mic is on and a note box is open, Chrome's built-in speech recognition sends that short stretch of audio to Google to turn it into text. Only the resulting text is saved in the report.
• Auto notes, while "Auto-annotate from voice" is on. It's on by default, and you can turn it off in Bugcap's Settings (the gear in the popup). While it's on, for as long as the mic is unmuted during a recording, Chrome's speech recognition sends your audio to Google to turn it into text. Bugcap keeps only the sentences that contain phrases like "this is broken" and saves them as notes, which you can edit or delete. The rest of the transcript is thrown away.
• Console logs, warnings and errors from the recorded page and the frames embedded in it, including failed assertions and Content Security Policy violations.
• Network requests made by the page: URL, method, status, timing and size. For failed fetch and XHR requests, also the request and response headers and bodies, with authorization headers, cookies, tokens, passwords and anything that looks like a card number replaced by [masked]. For WebSockets and server-sent events, only connection times and message counts and sizes, never message contents.
• Steps: clicks, double and right clicks, drags, form field changes, form submits, page navigations (including in-app route changes), keyboard shortcuts such as Enter, Escape or Ctrl+K, scrolling, window resizes, copy and paste actions, browser dialogs, dialogs, menus, tabs and messages that appear on the page, and going offline or online. Each step names the element used (its label, role and the section of the page it's in) and is linked to the requests, errors and page changes that followed it.
• What was typed or chosen in form fields, unless you turn off "Record typed values in steps" in the extension's settings. Values are cut to 200 characters. Password, email and phone fields, card and one-time-code fields, fields whose name or label looks sensitive (such as token, secret or card number), and anything inside an element marked data-bugcap-mask are shown only as (masked). Anything that looks like a card number, social security number or access token in other fields is replaced too. For file uploads, only the number and type of files are recorded, never their names or contents. Clipboard contents are never recorded.
• Performance data: Web Vitals, page load timing, long tasks and JavaScript memory use.
• App state at the start and end of the recording: the names of cookies, and the keys of local and session storage with each value's type and length. Cookie and storage values are never recorded. If the site uses Bugcap's page API, also the user and context it provides.
• A replay of the page's structure and changes, used to inspect the page as it looked during the recording. Text typed into form fields is masked in the replay, and password fields are never recorded.
• Device information such as browser, operating system, screen size, language and connection type, plus the page URL and title.

So that a report can show what happened just before you pressed record, the extension's page script keeps the last 200 console and network events in the page's own memory. They're added to a report only when you start a recording, and are never sent anywhere otherwise.

Reports are stored locally in your browser. Exports (PDF, Markdown and ZIP) are files saved to your device. If the extension isn't connected to a bugcap.io account, a recording's contents are sent to us only if you choose "Share via link". When it is connected, parts of each recording are sent while you record, as described in the next section. The extension does send usage analytics, described below.

Live upload and AI summaries (connected accounts)

While the extension is connected to your bugcap.io account, it sends parts of a recording to bugcap.io while you record instead of after:

• The video, uploaded in pieces as it's recorded, so the share link is ready as soon as you stop.
• For the AI title and summary: your microphone audio in 10-second pieces (silent pieces are skipped), each annotation and its frame the moment you make it, screenshots of key moments such as errors and failed requests, and the steps, console errors and failed requests as short lines, every few seconds. Typed values are masked exactly as they are in the report, and request URLs are sent without their query strings.

Our server turns the audio into a transcript and writes a title, a summary, reproduction steps, a severity and labels for the report using Cloudflare Workers AI. The AI runs only on our server: the extension never contacts an AI provider and holds no AI keys, and nothing is sent while the extension is disconnected. Cloudflare processes this data to return the result and doesn't use it to train models. To keep a recording entirely in your browser, disconnect the extension (Settings, Account, Disconnect). Nothing is sent while disconnected, and reports then get no AI title, summary or transcript.

Extension usage analytics

To understand how the extension is used and fix problems, it sends usage events to PostHog. These record which features you use, such as starting and stopping a recording, muting the mic, exporting, sharing and the viewer tabs you open, along with counts and sizes (for example, how long a recording was, how many console errors and failed requests it captured, how many steps of each kind it recorded, how many pages were visited and how many typed values were masked), the hostname of the site you recorded, error messages from the extension itself, your extension, browser and operating system versions, your language, and a random ID created when the extension was installed. When a live upload to bugcap.io fails during a recording, the extension also records which kind of upload it was and the error status. PostHog also derives an approximate location from your IP address. Without an account, events from one installation are grouped under that random ID, so we can see how a single installation uses the extension over time, but not who you are. Once you connect a bugcap.io account, those earlier events and new ones are linked to your account's user ID and organization, and PostHog receives your email address, name, plan and organization name. When you disconnect, the extension creates a new random ID, so later events aren't linked to your account.

When you remove the extension, Chrome opens a bugcap.io page that records the removal along with the random ID, your user ID if an account was connected, and the extension version. With usage analytics off, the page still opens but nothing is recorded. On that page you can also send us feedback and, if you want a reply, your email address. What you send is stored in our database and in PostHog with the same random ID, user ID and version, and your email is added to that profile. You can also choose to get emails about future releases, and every email has an unsubscribe link.

Usage analytics never include the contents of a recording: no video, audio, console messages, network requests or bodies, step text or typed values, page titles, full URLs, cookies or storage. You can turn usage analytics off at any time with "Share anonymous usage data" in the extension popup.

Your bugcap.io account

You need an account only to share reports as links. Sign-in runs on WorkOS AuthKit, which handles your password, so Bugcap never sees or stores it. For an account we store:

• Your name and email address. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider through WorkOS.
• The date you accepted our Terms of Service and this policy.
• Tokens that connect the extension to your account. They're stored hashed, you can revoke them from your dashboard, and they're revoked automatically if you leave your organization.

You can change your name and email address on the Settings page. The change is made in WorkOS and copied to Bugcap the next time you sign in.

Organizations and teams

Every account belongs to an organization. Members of an organization can see its shared links, its connections and whether reports were forwarded. For an organization we store its name and, if an admin adds one, its address. When an admin types an address, the typed text passes through our server to Google Places to suggest matching addresses; no user or organization identifiers are sent to Google.

Admins can invite teammates by email. WorkOS sends the invitation and stores the invited email address. An admin can also claim the domain of their verified email address, so that anyone who signs in with an email address on that domain joins the organization automatically. WorkOS stores the claimed domain, and an admin can release it at any time.

Shared reports

When you share a report, we store the video, the report data (logs, network requests, steps, performance, app state and device information), the page replay, a thumbnail and a short preview animation. We also store the report title, page URL, duration, file size, a view count and when it was first viewed. Shared links belong to your organization. If the recording had an AI summary, the transcript, annotations, key-moment screenshots and summary are kept with the shared report.

Anyone with the link can view a shared report. Links use random, unguessable IDs and share pages ask search engines not to index them. When you paste a link into Slack, a social app or another service that shows link previews, that service fetches a preview image showing the report's title, length, the site it was recorded on and its thumbnail. Review a report before you share it, because it contains what was on screen and in the logs. You can delete a share you uploaded from your dashboard at any time, which also deletes its files.

Every shared report also has a plain-text Markdown version at the link followed by /report.md, with the summary, timeline, transcript and links to the key-moment screenshots, so AI assistants and other tools can read it. It's available to anyone with the link, like the report itself.

Anyone signed in to bugcap.io who has a link can comment on the report's timeline, react to comments and draw on the video frame. We store each comment's text, its time in the video, any drawing, reactions, who wrote it and when, and who resolved it. Comments are visible to anyone with the link, shown with the author's name and profile picture, never their email address. Members of the report's organization can mention each other, which shows them each other's names. We email the person who shared the report about new comments and email anyone who is mentioned. Deleting a comment hides it; deleting the shared report deletes all of its comments.

Connections

Your organization can connect Slack, Linear or Notion, or add a webhook to its own endpoint, so each report its members share is forwarded there automatically. When an admin connects one, WorkOS keeps the access tokens it grants, and we store the name of the connected workspace and the channel, team or database chosen. A webhook's URL, custom headers and signing secret are kept encrypted in WorkOS Vault. Slack and Discord webhook URLs receive a formatted message. For each shared report we send its title, link, page URL, duration, its AI summary, severity and labels if it has them, counts of console errors, failed requests, steps, pages visited and frustrated clicks, the step just before the first failure, the first few error messages and failed request URLs, poor Web Vitals, the browser and operating system, and the app version and user ID if the site provided them. We keep a record of each delivery attempt, including its status, any error and how long it took, and a link to the item it created. Failed deliveries are retried up to 5 times in total. The video and full report data stay on bugcap.io and are only reachable through the link. Disconnecting a connection on bugcap.io deletes its connection and delivery records; items already created in the other tool stay there.

Product updates

You can sign up on bugcap.io or in the extension to get occasional product updates by email. You don't need an account. For this we store your email address, your subscription status, where you signed up, and when you signed up and unsubscribed. Every update includes a one-click unsubscribe link.

How we use data

We use data to provide the service: to sign you in, host and show your shared reports, enforce plan limits such as the amount of shared video, and keep the service secure. We also use your email address to send account emails: a welcome email when you sign up, a one-time notice when someone outside your organization first views a report you shared, and notices when a report you shared is forwarded or fails to forward. Admins also get an email when a member's report fails to forward. Some of these emails show your organization's name. WorkOS sends sign-in emails such as password resets, email verification and team invitations. If you subscribe to product updates, we use that email address only to send those updates, and you can unsubscribe at any time. Signing up for an account doesn't subscribe you. We don't sell data or show ads.

Website analytics

To understand how people use bugcap.io and improve it, the website uses Google Analytics and Microsoft Clarity on every page, including shared report pages. They collect pages visited, referrers, approximate location, device and browser information, and how you interact with the page, such as clicks, scrolling and mouse movement. Clarity also makes session recordings and heatmaps of how pages are used, so what's shown on a page, including a shared report, can appear in those recordings. The website also uses Google Ads conversion tracking to measure whether visits came from our ads. These services set their own cookies. Apart from these, the only cookies bugcap.io sets are for signing in. Our server also sends records of product activity, such as sign-ups, shares, deliveries, emails sent, each step of a recording reaching our server (for example how many timeline entries, narration pieces, screenshots and annotations arrived, their sizes, and how long transcription took) and how people use the report viewer on share pages (the tabs and filters they use and the steps they open, as counts and names of features, never report contents), to PostHog, with your account's user ID and organization where there is one, so we can understand usage and fix problems. The website also uses PostHog in your browser to record pages visited, referrers, device and browser information and which buttons and links you click. The text of what you click is masked, so report contents on shared pages aren't sent, and PostHog doesn't record sessions. When you're signed in, these browser events are linked to your user ID, email address, name, plan and organization. The Chrome extension doesn't use Google Analytics, Google Ads or Clarity; its usage analytics go to PostHog, as described above.

Service providers

• Railway hosts the website, the database and file storage for shared reports.
• WorkOS handles sign-in, account passwords, organizations, team invitations and domain claims, stores your name and email address, keeps the access tokens for Slack, Linear and Notion, and stores webhook secrets encrypted.
• Cloudflare Workers AI transcribes narration and writes AI titles and summaries for connected accounts, and receives the audio, annotations, screenshots and masked steps described above.
• Google Places suggests addresses when an admin edits the organization's address.
• Google and GitHub handle sign-in, only if you choose to sign in with them.
• Resend delivers account emails and product update emails, and receives your email address and the content of those emails.
• Google Analytics measures website usage.
• Google Ads measures the performance of our ad campaigns.
• Microsoft Clarity measures website usage and records sessions and heatmaps.
• PostHog receives product activity records, server logs, website usage events and the Chrome extension's usage analytics.
• Slack, Linear, Notion and any webhook endpoint your organization adds, such as Slack or Discord webhooks, receive the report details listed above, only for the connections you set up.

We may also disclose data when the law requires it.

Retention

Shared reports are kept until you delete them or your account is deleted. Account data is kept until your account is deleted. Product update subscriptions are kept until you ask us to delete them; after you unsubscribe we keep only the record that you did, so we don't email you again. Reports stored by the extension stay in your browser until you delete them or uninstall the extension. Audio, annotations, screenshots and steps sent while recording are deleted within 30 days if the recording is never shared, and right away if you discard the recording or delete it before sharing; for a shared report they're deleted with it.

Your choices

• Delete shared reports and revoke extension tokens from your dashboard.
• Connect, pause or disconnect connections on the Connections page.
• Update your name and email address on the Settings page.
• As an admin, edit your organization's details and release a claimed domain on the Team page.
• Use the extension without an account. Local recording and exports never need one.
• Disconnect the extension in its Settings to stop sending recordings while you record.
• Turn off the extension's usage analytics with "Share anonymous usage data" in the extension popup.
• Unsubscribe from product updates with the link in any update email.
• Block analytics on bugcap.io with your browser's tracking protection or a content blocker. The site works the same without it.
• To delete your account or get a copy of your data, email [email protected]. Self-serve account deletion isn't available yet, so we handle these requests by hand.

Security

Data is sent over HTTPS. WorkOS handles passwords, so Bugcap never stores them. Extension tokens are stored hashed, webhook secrets are encrypted in WorkOS Vault, and shared files are served through short-lived signed URLs. No system is perfectly secure, so please contact us if you find a problem.

Children

Bugcap isn't meant for children under 13, and we don't knowingly collect data from them.

Chrome Web Store Limited Use

The use of information received from the Bugcap extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. Significant changes will be announced on the site.

Contact

Questions or requests about privacy: [email protected]. See also our Terms of Service.