Privacy policy
Last updated 26 October 2026
Screencrab.me is a Chrome extension and web app for bug reports: screenshots and recordings with the console and network activity that explains them. This policy covers the extension, the app at app.screencrab.me and this site.
Who we are
Screencrab.me is run by Adam Lynch, a sole proprietor in the United States. Write to adam@verifesto.com about anything in this policy.
We play two roles:
- For your account, billing and this site, we decide what is collected and why (we are the “controller”).
- For what you capture (reports, screenshots, recordings and logs), we keep and process it on behalf of the organization it belongs to (we are its “processor”). The organization’s owners decide what is captured and who sees it. We offer a data processing agreement on request.
What we collect
Your account. Your name, email address and password (stored only as a secure hash), the organizations you belong to and your role in each, and the email addresses of people you invite.
What you capture, and only when you choose to. When you take a screenshot or make a recording and save it:
- the screenshot or video, and sound if you turn on the microphone or system audio;
- what you write about it: titles, descriptions, steps and severity;
- the page’s address and title, and your browser, operating system and screen size;
- the page’s console messages and errors, and its network requests: their addresses, methods, status codes, timing and headers. Request and response bodies are not captured.
Before any of it leaves the page, the extension removes what looks secret: passwords and tokens in addresses, cookies and authorization headers, and keys, tokens and signatures in logged text. Use the blur tool for anything else on screen that shouldn’t be kept.
What stays on your device. On sites you have given the extension access to, and only in tabs where you’ve started capturing, it keeps the last 10 minutes of console and network activity in your browser, so a screenshot can show what led up to it. That stays on your device unless you save a finding, and is forgotten when you stop capturing in that tab or close it. A recording that hasn’t finished uploading is kept in your browser for up to a week, so it can be sent again.
Billing. Paddle sells our subscriptions as merchant of record and handles payment. We receive the buyer’s name, email address, country and subscription details, never card numbers.
Technical data. Our servers log requests, including IP addresses and browser details, to keep the service secure; these logs are kept for up to 30 days. When something breaks, an error report goes to Sentry with the error and where it happened, but no names, email addresses, IP addresses, cookies or request bodies, and nothing from the sites you capture.
Cookies
The app uses only the cookies it needs to sign you in and protect your session. This site sets no cookies and uses no analytics or advertising trackers.
How we use it
| What for | Why we may |
|---|---|
| Running the service: your account, your organizations, storing and showing what you capture, the emails it sends | It’s what you signed up for (our contract with you) |
| Billing, tax and accounting records | The law requires it |
| Security, preventing abuse, fixing errors | Our legitimate interest in a safe, working service |
The emails we send are about your account and your work: confirming your address, invitations, reports published in your projects, and trial and billing notices. We don’t send marketing email and we don’t sell or rent personal data. We don’t use what you capture for anything but showing it to the people you share it with.
Who else handles it
We use a few providers to run the service, listed on the subprocessors page. Beyond them, what you capture is seen by the people in your organization who can see that project, and we disclose data only if the law requires it.
Where it’s kept
Our server is in the United States (OVHcloud US, in Virginia). Screenshots, recordings and backups are stored in the European Union (Cloudflare R2). Some providers also work from the United States, such as Sentry. Where personal data from the EU, the UK or Switzerland goes to the United States, it’s protected by the EU–US Data Privacy Framework where a provider is certified under it, or by the European Commission’s standard contractual clauses.
How long we keep it
- Your account: until you delete it.
- Screenshots and recordings: as long as your plan keeps media (90 days on Starter, a year on Team, until you delete it on Business), counted from when each was captured.
- When a trial ends or a subscription is cancelled without being renewed: owners are emailed a week ahead, then the organization’s screenshots and recordings are deleted 30 days after it ended. Reports and their text stay until the organization is deleted.
- Server logs: up to 30 days.
- Backups: encrypted, and kept for 30 days, so deleted data leaves them within 30 days.
You can delete your account, or an organization you own, at any time from the app (Account, or the organization’s Settings). It’s deleted straight away, and leaves our backups within 30 days. Deleting an organization deletes everything in it; deleting your account leaves what you wrote in your organizations with them, without your name.
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to receive it in a portable form, or to stop or limit how we use it. Write to adam@verifesto.com and we’ll answer within a month.
For what an organization has captured, its owners decide, so we’ll pass your request to them and help them answer it. You can also complain to your data protection authority.
The Chrome extension
The extension asks for access to a site only when you start capturing there. Its permissions are used only to take screenshots and recordings you ask for, to read the console and network activity described above, and to send what you save to your Screencrab.me account. Its use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: it is used only for these features, never sold, never used for advertising, and never read by people except to keep the service secure, to comply with the law, or with your permission.
Security
Everything travels over encrypted connections. Screenshots and recordings are stored privately and reached only through links that expire within minutes, after checking who’s asking. Passwords are hashed and backups are encrypted.
Children
Screencrab.me is for work, and not for anyone under 16.
Changes
If we change this policy in a way that matters, we’ll email account owners before it takes effect. The date at the top says when it last changed.