Privacy and what is stored

• Visitor counter: page path, event, referrer and a random visitor id. No names, no addresses, no cookies set by us.
• Server-request log: method, server, path pattern (ids replaced by :id), status and time. Never content, never query strings.
• QA recordings: full calls, clicks and typing — but passwords, hidden fields, card numbers, tokens, cookies, sign-in headers and anything named like a secret are blanked before leaving the browser and again on the server. Recording only happens with a valid code, on the tab where it was started, and exported sites show a red badge while recording.
• Captures: what the public page showed, plus signed-in pages only when you saved a test sign-in.
• Deleting: deleting a QA session deletes all its steps and replays. Deleting a project deletes everything in it.

Tell people before recording them, and only record accounts you are allowed to use.

Recorder update. Download and reload version 1.0.2 before recording. The extension now captures real clicks, inputs and page changes in isolation, plus browser-observed request method, address, status and time. It no longer collects request/reply headers or bodies; those fields are unavailable for new extension sessions. Exported-site recording still collects redacted call details but is page-based, not a certified activity log.