- Storage
- IndexedDB in your Chrome profile
- Telemetry
- None in the standalone extension
- Policy
- Privacy policy
What stays local
Sessions, screenshots, video, audio and drafts are stored in the browser’s IndexedDB. Deleting a session in the side panel deletes it there. Recording, annotating, markup and ZIP export work without any server or account.
What leaves, and only when you set it up
| Integration | What is sent | Where |
|---|---|---|
| Transcription | Recorded microphone audio, including spoken annotation comments | Deepgram, OpenAI or ElevenLabs |
| AI summaries and names | Up to 60,000 characters of text evidence; no media | OpenAI, Anthropic, Google or your compatible endpoint |
| Publishing | The report, session data, transcripts and included media | Your Cloudflare Pages project |
| GitHub issues | Issue title, summary and report link | The repository you choose |
| Annotation vocabulary | A bounded excerpt of visible headings, navigation and labels (no input values, editable or hidden content); then a short term list | Your AI model; the term list to Deepgram or ElevenLabs |
| Proofline connection (preview) | The same data, for the features you run through Proofline | Proofline; see connected-mode data handling |
API keys and tokens live in extension storage, separate from recordings, and are never written into exports or published reports.
Redaction at capture time
Redaction is on by default and runs before data is written to storage, so the unmasked value is never saved. By default it masks:
- Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token and proxy auth headers.
- JSON and form fields whose names look like tokens, secrets, passwords, API keys, sessions, auth or credentials.
- URL query parameters with names like those.
- Password inputs.
You can add header names, body key patterns and URL parameter patterns, or turn redaction off for a session, in capture settings.
What redaction does not do
Redaction is pattern-based. It does not read screenshots, video or audio, and it cannot recognise personal data in ordinary fields, such as a customer name in a response body or an email typed into a form. Review evidence before publishing or attaching it anywhere, and use test accounts when you can.
Record your next bug instead of describing it
Session Recorder is free and open source under the AGPL-3.0. Recording and ZIP export need no account. AI, transcription and publishing are optional: use your own providers, whose charges apply, or use credits with the optional Proofline connection preview when it reaches your installed version.