Privacy policy
Last updated 22 August 2026. Applies to the Bugpacker Chrome extension.
Bugpacker does not collect anything. Everything it captures stays on your computer, is assembled into a ZIP file on your computer, and is saved to your own downloads folder. There is no account, no server of ours, and no analytics. The single exception is licence checking, described below.
What Bugpacker captures
When you start a recording, Bugpacker captures — on your machine only:
- screenshots of the visible page
- console output, uncaught errors, unhandled promise rejections and Content Security Policy violations, from the moment recording starts
- network activity: method, URL, status, timing, and any server request id in the response headers
- the actions you take: clicks, which fields you typed into, structural key presses such as Tab and Enter, scrolling, and page navigations
- a snapshot of the page’s HTML, the element you marked, and the state of form fields
- environment details: browser and OS version, GPU, screen and window size, colour scheme and motion preferences, language, timezone, and the names of cookies and storage keys
None of this is transmitted anywhere. It is held in your browser’s session storage until you export it or close the browser, whichever comes first.
What Bugpacker deliberately does not capture
| Not captured | Why |
|---|---|
| The text you type | Bugpacker records that a field was typed into, never what was typed |
| Passwords | Excluded from the report entirely and masked in screenshots |
| Cookie and storage values | Only their names are recorded |
| Inline script contents | These routinely carry configuration and tokens, so their bodies are removed |
Redaction
Every capture is scrubbed before you review it. Scrubbing is always on and there
is no setting anywhere that disables it. Email addresses, phone numbers, card
numbers, national ID and bank account numbers, tokens, keys, authorisation headers
and secrets in query strings are replaced with placeholders that describe the format
but not the content — for example [PHONE_1: (NNN) NNN-NNNN].
Screenshots are scrubbed by locating sensitive fields in the page and masking where they sit. Payment fields, passwords, one-time codes, anything you drew a mask over, and anything matching a selector you added in settings are filled solid. Lower risk fields — email, phone, name, address — are pixelated instead, because seeing that a field held something, and roughly how much, is often the point of the report.
Pixelation is not a one-way transform. Short text over a small alphabet in a known font can in principle be recovered from a mosaic, which is why it is not used anywhere the content would be worth recovering.
Masking is still best effort and cannot catch everything an image happens to show, because a bitmap cannot be pattern-matched and text rendered outside a form field is invisible to this. You review the whole package before anything is saved.
Bugpacker is a bug-reporting tool, not a data-loss-prevention, anonymisation or compliance product. It cannot guarantee that all personal, confidential or regulated information has been removed, and you remain responsible for the contents of any package you choose to share.
What you type is not scrubbed
Scrubbing applies to what Bugpacker captured: the console, the network log, the DOM snapshot, the form state, the page title and URL. It does not apply to what you write.
The title, steps, expected and actual results and notes go into the package
exactly as you typed them. So do the two optional Filing details in
settings — a reporter name or email, and a project or board key — which travel in
report.json with every package you export, so an issue tracker can file
it without asking who sent it. Both are empty unless you fill them in, and the review
page shows what is attached before you download.
This is deliberate: they are your words in your report, and rewriting them would make the report say something you did not write. But it means an email address you type is an email address in the package, and if a package might leave your team, the filing details are the setting to leave empty.
Network requests Bugpacker makes
Exactly one: licence verification against api.lemonsqueezy.com, our
payment provider. Activating, checking or releasing a licence sends your licence key
and a device label you can see in Settings. No page content, no captured data, and
nothing identifying the sites you visit is ever included. Checking happens at most
once a day. If you have no licence, Bugpacker makes no network requests at all.
Payment itself is handled entirely by Lemon Squeezy’s hosted checkout. We never see or store your payment details.
Storage
| Where | What | How long |
|---|---|---|
| Session storage | The recording in progress and the package awaiting review | Until you close the browser |
| Local storage | Your settings and your licence key | Until you remove the extension |
Removing Bugpacker deletes all of it.
Permissions, and why each one exists
| Permission | Why |
|---|---|
| activeTab | Capture the page you invoked Bugpacker on, and nothing else |
| scripting | Draw the region selector, record console and network activity, read the page snapshot |
| storage | Your settings, your licence, and the recording in progress |
| downloads | Save the finished ZIP to your downloads folder |
| sidePanel | The capture panel itself |
| alarms | Stop a forgotten recording, and re-check the licence daily |
| webNavigation | Re-attach the recorder when the page navigates mid-recording |
| webRequest | Observe whether requests succeeded or failed, without modifying any of them |
| api.lemonsqueezy.com | Licence verification, as described above |
| Access to a site, on request | Asked for only when a reproduction crosses origins, and only for the site you are recording |
Bugpacker never requests access to all sites at install time.
Children
Bugpacker is a developer tool and is not directed at children.
Changes
Material changes to this policy will be published on this page and noted in the extension’s release notes.
Contact
Questions about this policy: privacy@bugpacker.com