Privacy policy

What stays in your browser

To include the minutes before you press record, the extension runs on every page you open and keeps a rolling buffer of that page's activity in memory, on your computer: the last five minutes, then it is thrown away. Closing a tab discards its buffer. Nothing in it is written to disk or sent anywhere unless you start a capture.

The buffer holds:

• console messages, uncaught errors and their stack traces;
• network requests made by the page (fetch, XHR, WebSocket and WebRTC data channels): URL, method, status, timing, headers the page can see, and request and response bodies, truncated;
• page navigations and resources that failed to load;
• basic environment details: browser and OS (user agent), page URL, window size, pixel ratio, graphics card name and the page's build tag if it publishes one.

The extension does not record keystrokes, the values you type into forms, or the page's HTML.

What is uploaded, and when

Only when you start a capture, by clicking the extension or pressing its shortcut. When the recording stops (or the screenshot is cropped), the extension uploads to your Rekod dashboard:

• the video of that tab (no audio, up to 3 minutes) or the screenshot, plus a still frame for the thumbnail;
• the console and network entries from the buffer and from the recording;
• the page URL and the environment details above;
• the title and description you type, when you save.

Uploading starts when the capture stops, so it is ready by the time you finish writing. If you press Discard, the upload is deleted. If you close the composer without saving, the unsaved upload is deleted automatically within two days.

Masking secrets, and its limits

Before anything enters the buffer, the extension masks common credentials in your browser: authorization and cookie headers, API-key headers, fields and URL parameters with names like password, token, secret or key, bearer tokens, JWTs, and well-known API key formats. Email addresses in logs are partly masked.

This is best effort. A secret with an unusual name, or personal information in a request body or console message, can still be captured. The video and screenshots are not redacted — they show exactly what was on screen. Look before you share a rekod.

Your account and the session cookie

You sign in to the dashboard with Google. We receive your name, email address and profile picture from Google, and use them to identify your account and workspace. The extension never asks for a password: it reads the dashboard's own sign-in cookie (rekod.session_token) and sends it only to that dashboard, to prove the upload is yours. It does not read any other site's cookies.

The extension stores one setting on your computer (chrome.storage): where you last dragged its on-page control.

Where it is stored, and who can see it

• Recordings, logs and screenshots are stored in a private storage bucket, and account and report records in a database, both hosted by Supabase (Seoul region). The dashboard runs on Vercel.
• A rekod is visible to the members of the workspace it was recorded in.
• Pressing Share creates a link that lets anyone who has it view that one rekod, without signing in. Stop sharing turns the link off.
• A comment shows its author's email address to everyone who can see the rekod, share links included.

We do not sell your data, use it for advertising, or share it with anyone else. There are no analytics or tracking scripts in the extension or the dashboard.

Keeping and deleting

A rekod is kept until you delete it. Deleting removes its video, screenshot and logs from storage and its record from the database; it is not kept in a trash folder. To delete your account and everything in it, email rawataditya795@gmail.com.

Self-hosted instances

Rekod can be self-hosted. If your organisation runs its own dashboard, your recordings go to that server and are governed by that organisation, not by this policy.

Chrome Web Store User Data Policy

The use of information received from Chrome extension APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide Rekod's bug-reporting features.

Children

Rekod is a developer tool and is not directed at children under 13.

Changes and contact

If this policy changes, the date at the top changes with it. Questions or requests: rawataditya795@gmail.com.