Privacy Policy

Privacy Policy for Puggy

This policy explains what Puggy collects during QA session recording, how the data is used, and what controls you have over it.

Last updated October 4, 2026
Effective December 2, 2025
Applies to Chrome extension and web app

Summary

  • We only collect session data when you actively record sessions.
  • Anonymous usage analytics and crash reports help us improve Puggy — they never include your recorded session content.
  • Passwords, payment details and other secrets are kept out of recorded form inputs and network and console logs automatically. The screen video is not masked automatically; you can blur anything on screen while recording.
  • We do not sell your data.
  • You can delete sessions, revoke share links, and control integrations.
  • All communication is protected using HTTPS/TLS.

Introduction

Puggy ("we", "our", or "the Extension") is a professional QA session recorder designed for developers, testers, and QA teams. This Privacy Policy explains how we collect, use, store, and protect your information when you use Puggy.

By installing and using Puggy, you agree to the collection and use of information in accordance with this policy.

Information We Collect

1. Data Collected During Recording Sessions

When you actively start a recording session, Puggy collects the following data:

Network Activity

  • HTTP/HTTPS request URLs
  • Request and response headers
  • Request and response bodies
  • HTTP status codes
  • Request timing information
  • HAR (HTTP Archive) format logs

Console Logs

  • JavaScript console messages (log, warn, error, info)
  • Error stack traces
  • Console timestamps

User Interactions (When Enabled)

  • Click events and coordinates
  • Form inputs (with sensitive data protection)
  • Scrolling behavior
  • Keyboard shortcuts
  • Navigation events
  • Element selectors and attributes

Visual Data

  • Screenshots of the browser tab
  • Screen recording (video) of the browser tab

Performance Metrics

  • Page load times
  • First Contentful Paint (FCP)
  • Time to First Byte (TTFB)
  • Memory usage statistics

Session Metadata

  • Session start and end time
  • Page URL and title
  • Browser user agent
  • Session duration

2. Authentication Data

  • Google account email address (via OAuth)
  • Supabase authentication tokens
  • Organization membership information

3. Integration Data (Optional)

When you connect third-party services:

  • API credentials for Jira, ClickUp, GitHub, or Slack (stored securely in your Supabase database)
  • Integration configuration settings

4. Usage Analytics and Error Reporting

To improve Puggy and diagnose problems, we collect a limited amount of anonymous, aggregated data independently of recording sessions. This data never includes the content of your recorded sessions (network bodies, console logs, screenshots, or video).

Usage Analytics (Google Analytics 4)

  • Anonymous product-usage events, such as which features or buttons are used and basic lifecycle events
  • A randomly generated analytics identifier that is not your name, email, or account and is not linked to your identity
  • Sent over HTTPS; no recorded session content, page content, or form values are included

Error and Crash Reporting (Sentry)

  • Error messages and stack traces generated by Puggy when it malfunctions
  • The application version and the component where the error occurred
  • Configured to exclude personal information and to strip request and user data before transmission
  • No recorded session content is ever sent to the error-reporting service

Usage analytics and error reporting are optional and are disabled in builds that are not configured with the corresponding keys.

What We DO NOT Collect

  • Browsing history from tabs not being recorded
  • Data from other extensions
  • Personal information beyond what's captured in active recording sessions
  • Recorded session content when recording is inactive (note: anonymous usage analytics and crash reports may still be sent — see "Usage Analytics and Error Reporting" above)
  • System information outside the browser
  • Location data
  • Device identifiers beyond standard browser information

Sensitive Data Protection

Puggy keeps sensitive values out of a recording automatically, in the places where it can recognise them.

Form inputs

When interaction capture is on, Puggy does not keep the value typed into:

  • Password fields (any input with type="password")
  • Payment fields: any input whose autocomplete attribute is a card field (cc-number, cc-csc, cc-exp and the rest of the cc- family)
  • Other secret fields: autocomplete="current-password", "new-password" or "one-time-code", and fields whose name or id suggests a password, secret, token, one-time code, card number, CVV/CVC or Social Security Number

The value is dropped, not stored in any form; the recording only notes that a value was withheld. Text shown on the page that looks like an email address, a card number or an access token is left out of page snapshots the same way.

Network and console logs

Before network requests and console messages are saved, Puggy replaces these with [REDACTED]:

  • Authorization headers, cookies, API keys, CSRF tokens and bearer tokens
  • Values whose name indicates a password, secret, token, key, session or signature, in URL query parameters, URL-encoded form submissions and JSON bodies
  • Card numbers, CVV/CVC and security codes, and Social Security Numbers, in the same places
  • JSON Web Tokens in JSON bodies and console messages

Screen recording and screenshots

Video and screenshots capture the page exactly as it appears. Browsers already hide what you type into password fields, but other information visible on screen, including a card number typed into a payment form, is captured as shown. Use Blur page element on the recording toolbar to hide any part of the page before it is captured; blurred elements stay blurred in both the video and screenshots.

How We Use Your Data

Primary Uses

  1. Session Recording: Capture QA sessions for debugging and testing purposes
  2. Session Replay: Play back recorded sessions for analysis
  3. Bug Reporting: Create detailed bug reports with session context
  4. Team Collaboration: Share sessions with team members (when you choose to)

Data Storage

  • All session data is stored in Supabase storage
  • You maintain complete ownership and control of your data
  • Data is encrypted in transit using HTTPS/TLS
  • Authentication tokens are stored securely in Chrome's storage API

Your Rights

You can at any time:

  • View all your recorded sessions in the Puggy console application
  • Delete any session permanently
  • Revoke session share links
  • Delete your account entirely

Data Security

Security Measures

  1. Encryption
    • All data transmitted over HTTPS/TLS
    • Authentication tokens stored in Chrome's secure storage
  2. Access Control
    • Recorded session data is only collected during active recording (anonymous usage analytics and crash reports are covered separately above)
    • Sender validation on all message passing
    • Content Security Policy prevents code injection
    • Origin validation for external communications
  3. Authentication
    • Google OAuth 2.0 for secure sign-in
    • No passwords stored by the extension
    • Session tokens with automatic refresh
  4. API Security
    • All integration credentials stored server-side
    • Never exposed to browser console or client-side code
    • Proxied through secure Supabase Edge Functions

User Controls

Recording Control

  • Recording is completely manual - you must click "Start Recording"
  • Clear visual indicator when recording is active
  • You can stop recording at any time
  • You can choose whether to capture user interactions

Data Management

  • Delete sessions individually or in bulk
  • Control session sharing (create/revoke links)
  • Configure which integrations are enabled
  • Set session expiration for shared links

Cookies and Tracking

Puggy does not use advertising cookies or tracking pixels. For anonymous product-usage analytics and error reporting we use Google Analytics 4 and Sentry, which collect only the limited, anonymous data described in "Usage Analytics and Error Reporting" and never your recorded session content.

Third-Party Services

Puggy relies on the following third-party services. Please review their privacy policies:

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top of this policy and displaying a notification in the extension popup for material changes.

Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Emailsupport@puggy.dev
Websitehttps://puggy.dev
Response timeWithin 48 hours
Document Version:
1.2
Policy Effective Date:
December 2, 2025
Last Reviewed:
October 4, 2026
©
2025 Puggy. All rights reserved.