Stepcairn privacy policy
Effective 2026-10-18 · applies to the Stepcairn Chrome extension, version 0.1.0 and later · publisher: Gilad Amar ("we")
1. Data the extension handles on your device
| Data | Where it is kept | How long |
|---|---|---|
| Guides: step titles, your notes, the labels of the buttons, links and fields you click, the option you picked in dropdowns, the address of each step's page (site and path only: query strings and fragments are dropped), the position of the click, and the screenshot of the visible part of the tab for each step | IndexedDB in your Chrome profile | Until you delete the guide or uninstall |
| Text you type into fields: not stored unless you switch on "Include typed text". Even then, at most 50 characters per field, and never for password fields or fields recognized as personal data. Password fields and, with auto-redaction on, emails, phone, card and account numbers found on screen are blurred in screenshots | Inside the guide (IndexedDB) | Until you delete the guide or uninstall |
| Settings: theme, the typed-text option, auto-redaction, and export branding (company name, colour, logo image you upload) | chrome.storage.local | Until you change them or uninstall |
| Recording state: which tab is being recorded and the step count | chrome.storage.session (memory) | Cleared when recording stops or the browser closes |
| License details if you activate Pro: the key, Lemon Squeezy activation ID, plan, the purchase email and expiry returned by Lemon Squeezy, and the last check time | chrome.storage.local | Until you deactivate the license or uninstall |
| Exports and imports | Exports (HTML, Markdown zip, print view, guide file) are written to your Downloads folder or Chrome's print dialog. Import reads only the guide file you select | Under your control |
Screenshots can show whatever was on screen while you recorded, including personal data on the pages you recorded. Review and blur steps before you share an export. None of this data is sent to us; we do not operate any server that receives it.
2. Data that leaves your device
License checks only. If you enter a Pro license key, the extension sends HTTPS requests to https://api.lemonsqueezy.com/v1/licenses/: activate (your key and a random instance name), validate (your key and the activation ID, at most once every 7 days, triggered by a once-a-day background check) and deactivate (when you click Deactivate). Lemon Squeezy (Merchant of Record) receives your IP address as with any web request and processes this data under its privacy policy. If you never enter a key, Stepcairn makes no network requests of its own.
Checkout happens on Lemon Squeezy's website, not in the extension. Guides you export are files; where they go after that is up to you.
3. Access to websites
- Page access (
<all_urls>) is an optional permission, requested the first time you press Record. Chrome requires it to take tab screenshots. You can remove it in Chrome's extension settings at any time; recording then asks again. - The recorder script is injected only into the one tab you chose to record, only while you record (and again after that tab navigates). It is never injected anywhere else, and stops when you press Stop.
- Stepcairn does not read your browsing history, other tabs, or other extensions.
- No remote code is loaded. All code ships inside the extension package (Content Security Policy
script-src 'self').
4. Permissions and why we need them
| Permission | Used for |
|---|---|
storage | Settings, license status and recording state on your device |
unlimitedStorage | Keeping guides with many screenshots in IndexedDB without hitting Chrome's default quota |
sidePanel | The recording controls and live step list next to the page |
scripting | Injecting the recorder into the tab you chose to record, when you press Record |
alarms | The once-a-day check of whether a Pro license is due for its weekly re-validation |
Optional page access (<all_urls>) | Taking the step screenshots (section 3) |
Host access to api.lemonsqueezy.com | License activation, validation and deactivation (section 2) |
5. What we don't do
- No analytics, telemetry, advertising, cookies or fingerprinting in the extension.
- We don't sell or transfer user data to third parties, except the license check described above.
- We don't use or transfer user data for purposes unrelated to the extension's single purpose.
- We don't use or transfer user data to determine creditworthiness or for lending purposes.
The use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.
6. Your choices and rights
Delete guides in the side panel, clear the logo in Settings, deactivate your license, or uninstall Stepcairn (Chrome removes its storage, including all guides). We hold no extension data on our servers. For purchase records held by Lemon Squeezy or any privacy question (including GDPR/UK GDPR requests), email busywright@mail.grokbot.com.
7. Children
Stepcairn is a workplace tool and is not directed at children under 16.
8. Changes
If a future version handles data differently, we will update this page and the effective date before releasing it.
9. Contact
Gilad Amar, Thailand · busywright@mail.grokbot.com