100% Client-Side Verified

Privacy Policy & Security Architecture

Version 1.0.0 • Effective Date: September 2026 • Certified Google Chrome Manifest V3

Core Privacy Guarantee: Workflow Recorder does not collect, track, monetize, or transmit any user data or credentials. All recorded steps, selectors, timestamps, and export scripts are processed and stored 100% locally in your browser's private IndexedDB storage.

External HTTP Calls

Zero tracking or telemetry

100%

Client-Side Processing

Air-gapped safe

AUTO

Password Masking

Scrubbed before storage

CSP

script-src 'self'

No remote execution

1. Zero Telemetry & Network Call Audit

Unlike commercial recorder plugins that stream keystrokes or analytics to cloud dashboards, Workflow Recorder enforces a zero-outbound policy. The extension contains:

No Google Analytics, Mixpanel, or Amplitude: Zero third-party tracker scripts.
No Sentry or remote crash reporters: Debugging logs reside strictly in your local developer console.
Zero AI API keys or cloud relays: Selector generation and test exports run purely in local browser memory.

2. Automatic Sensitive Data & Password Masking

Because browser recording touches active web pages handling authentication and personal data, the PrivacyGuard subsystem automatically protects sensitive data:

Password Fields: Any input matching type="password" is intercepted. Plaintext keystrokes never enter memory or IndexedDB and are saved as {{password}} tokens.
Financial & Identity Identifiers: Fields with labels or names matching credit card numbers, CVVs, Social Security numbers, bank accounts, or OTP tokens are automatically masked.
URL Token Scrubbing: Query parameters matching secret tokens (e.g. ?token=... or ?apiKey=...) are scrubbed from navigation records.

3. Chrome Extension Permissions Justification

Every permission declared in manifest.json is strictly audited and required for local functionality:

Permission	Technical Rationale	Data Scope
`storage`	Stores workflow definitions, step timelines, and user preferences locally in browser IndexedDB and `chrome.storage.local`.	100% Local
`tabs`	Detects URL changes, page reloads, and multi-tab transitions during active recording sessions.	Local Tabs Only
`scripting`	Dynamically injects the passive recording listener and floating HUD into target web pages when initiated by the user.	Active Recording Only
`downloads`	Allows users to download generated automation script files (e.g. `.spec.ts`, `.py`, `.json`) directly to their filesystem.	User-Initiated Downloads
`<all_urls>`	Required to inject the recording listener into arbitrary developer-specified websites and test environments.	Local DOM Events

4. User Data Control & Instant Purge

You have complete ownership over your workflow recordings:

Local Export: Export any workflow to canonical JSON or YAML for version control or offline backups.
Single-Click Wipe: Click "Clear All Workflows" in extension settings to permanently delete all IndexedDB records and screenshot blobs.
Uninstallation: Removing Workflow Recorder from Chrome immediately and automatically removes all associated storage.

5. Enterprise & Air-Gapped Compliance

Workflow Recorder's offline-only architecture satisfies strict compliance frameworks:

GDPR Article 25

Complies with Privacy by Design and Privacy by Default mandates with zero data transfer to external processors.

CCPA / CPRA

No personal consumer data is ever sold, shared, or collected across sessions or devices.

SOC2 Type II Aligned

Air-gapped and internal network friendly; safe for defense, healthcare, and financial engineering teams.