What Capture reads, and when
- When you capture (screenshot, area, full page, point at it, or save a replay): the page address and title, a screenshot, error messages from the page, failed and slow network requests (address, method, status and time only; never request or response bodies, headers or cookies), files that did not load, speed numbers recorded by the browser, and browser details (browser and version, system, window and screen size, zoom, language, time zone).
- Steps to reproduce: which buttons and links you clicked and which fields you used. Typed text is not included unless you turn on "Include typed text in steps"; password, card and one-time-code fields are never included.
- Recording from page load: only on sites where you turn on "Record errors and steps here". The record stays in that tab's memory and is read only when you make a report. Turning it off removes the permission for that site.
- Instant replay: only on the tab where you press Start, and only while it runs. The video stays in memory; a file is created only when you press "Save replay". Chrome shows that the tab is being captured.
Private details are hidden before anything leaves the page
Emails, card numbers (checked with the Luhn rule), phone numbers, long ID and account numbers, access tokens, password fields and anything a site marks private are blurred in screenshots and replaced in text, page addresses, console messages and steps. You can see exactly what will be sent under "What's sent", remove any section, and turn Capture off for any site. Automatic blur does not apply to replay videos.
Where your data goes
- To your tracker: only when you press Send, directly from your browser to your Jira site, GitHub's API or Linear's API. Their own privacy terms apply there. For GitHub, if you turn on "Keep files in a branch", screenshots and videos are stored in a "bastion-capture" branch of your repository.
- To a file: when you choose Download.
- Never to Bastion Helix. We have no server for Capture and receive nothing.
What is stored on your computer
- Settings and your tracker tokens, in Chrome's extension storage on this computer only (not synced).
- Reports, screenshots and videos, in this browser's extension database, until you delete them; reports are removed automatically after 30 days.
- Disconnecting a tracker removes its token and the permission to reach it.
Chrome Web Store user data policy
The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell user data or use it for advertising.