Privacy policy
Last updated 12 September 2026. Applies to the Bugpacker Chrome extension.
Bugpacker does not collect anything. Everything it captures stays on your computer, is assembled into a ZIP file on your computer, and is saved to your own downloads folder. There is no account, no server of ours, and no analytics. Bugpacker makes no network requests at all, with no exception.
What Bugpacker captures
When you start a recording, Bugpacker captures, on your machine only:
- screenshots of the visible page
- console output, uncaught errors, unhandled promise rejections and Content Security Policy violations, from the moment recording starts
- network activity: method, URL, status, timing, and any server request id in the response headers
- the actions you take: clicks, which fields you typed into, structural key presses such as Tab and Enter, scrolling, and page navigations
- a snapshot of the page’s HTML, the element you marked, and the state of form fields
- environment details: browser and OS version, GPU, screen and window size, color scheme and motion preferences, language, timezone, and the names of cookies and storage keys
None of this is transmitted anywhere. It is held in your browser’s session storage until you export it or close the browser, whichever comes first.
What Bugpacker deliberately does not capture
| Not captured | Why |
|---|---|
| The text you type | Bugpacker records that a field was typed into, never what was typed |
| Passwords | Excluded from the report entirely and masked in screenshots |
| Cookie and storage values | Only their names are recorded |
| Inline script contents | These routinely carry configuration and tokens, so their bodies are removed |
Redaction
Every capture is scrubbed before you review it. Scrubbing is always on and there
is no setting anywhere that disables it. Email addresses, phone numbers, card
numbers, national ID and bank account numbers, tokens, keys, authorization headers
and secrets in query strings are replaced with placeholders that describe the format
but not the content. For example, [PHONE_1: (NNN) NNN-NNNN].
Console output and page text are captured whatever they contain, so a credential a
site prints into its own console, or renders into the page, arrives as text like any
other. The rules above target that kind of string, including tokens, bearer and
authorization values, JWTs and credentials carried in a URL, but they are best effort
rather than a guarantee. Read console.log and the page snapshot before you
share a package: of everything in it, those two are the most likely to hold something no
rule recognised.
Screenshots are scrubbed by locating sensitive fields in the page and masking where they sit. Payment fields, passwords, one-time codes, anything you drew a mask over, and anything matching a selector you added in settings are filled solid. Lower risk fields (email, phone, name, address) are pixelated instead, because seeing that a field held something, and roughly how much, is often the point of the report.
Pixelation is not a one-way transform. Short text over a small alphabet in a known font can in principle be recovered from a mosaic, which is why it is not used anywhere the content would be worth recovering.
Masking is still best effort and cannot catch everything an image happens to show, because a bitmap cannot be pattern-matched and text rendered outside a form field is invisible to this. You review the whole package before anything is saved.
Bugpacker is a bug-reporting tool. It is not a data-loss-prevention, anonymization or compliance product, it cannot guarantee that all personal, confidential or regulated information has been removed, and you remain responsible for the contents of any package you choose to share.
What you type is not scrubbed
Scrubbing applies to what Bugpacker captured: the console, the network log, the DOM snapshot, the form state, the page title and URL. It does not apply to what you write.
The title, steps, expected and actual results and notes go into the package
exactly as you typed them. So do the two optional Filing details in
settings, a reporter name or email and a project or board key, both of which travel in
report.json with every package you export, so an issue tracker can file
it without asking who sent it. Both are empty unless you fill them in, and the review
page shows what is attached before you download.
This is deliberate: they are your words in your report, and rewriting them would make the report say something you did not write. But it means an email address you type is an email address in the package, and if a package might leave your team, the filing details are the setting to leave empty.
Network requests Bugpacker makes
None.
You do not have to take that on trust. The extension declares no host permissions,
which is the browser’s own record of the fact that it has nowhere to send anything. You
can see it on the extension’s listing under permissions, or open
manifest.json in the unpacked extension and find that
host_permissions is absent entirely.
Bugpacker is free, so there is no payment provider in the picture and no billing details for anyone to handle.
Storage
| Where | What | How long |
|---|---|---|
| Session storage | The recording in progress and the package awaiting review | Until you close the browser |
| Local storage | Your settings | Until you remove the extension |
Removing Bugpacker deletes all of it.
Permissions, and why each one exists
| Permission | Why |
|---|---|
| activeTab | Capture the page you invoked Bugpacker on, and nothing else |
| scripting | Draw the region selector, record console and network activity, read the page snapshot |
| storage | Your settings and the recording in progress |
| downloads | Save the finished ZIP to your downloads folder |
| sidePanel | The capture panel itself |
| alarms | Stop a forgotten recording after a configurable limit |
| webNavigation | Re-attach the recorder when the page navigates mid-recording |
| webRequest | Observe whether requests succeeded or failed, without modifying any of them |
Bugpacker never requests access to any site beyond the tab you open it on. If a reproduction navigates to a different site, capture stops at that point, and the package says the recording left the site. It reads the page you are recording; it never sends.
Reviewing this for an organization? There is a page written for security reviewers with the permission list, every outbound request, what is stored where, and how to verify all of it against the extension package yourself.
This website
Everything above is about the extension. This section is about
bugpacker.com and demo.bugpacker.com, which are different
things with different answers.
Both are static pages served by Cloudflare Pages. Like every web host, Cloudflare keeps request logs: IP address, user agent, the URL asked for, and a timestamp. That happens whether or not anyone looks at them, and it is how the pages get delivered at all.
There is no analytics script, no beacon and no cookie on either site. Nothing is stored in your browser by visiting them. The demo checkout is a deliberately broken page for testing the extension against; anything you type into it stays in the tab and is sent nowhere.
Children
Bugpacker is a developer tool and is not directed at children.
Changes
Material changes to this policy will be published on this page and noted in the extension’s release notes.
Contact
Questions about this policy: privacy@bugpacker.com