Privacy Policy

This policy describes the data handled by the Bug Black Box Chrome extension. Last updated: July 10, 2026.

Data the Extension Records

During an active recording session, Bug Black Box may collect browser context needed to reproduce and debug a web issue:

• Page URL and title for recorded tabs.
• Console logs and console errors emitted by the page.
• JavaScript error messages and stack traces.
• User click and submit metadata, such as a selector and safe visible label text.
• Failed network request metadata, including method, sanitized URL, status code, and browser network error text.
• A screenshot of the visible viewport from the root tab when recording stops, when Chrome allows capture.
• rrweb session replay events for local playback in the extension replay viewer.

Data the Extension Avoids Recording

Bug Black Box is designed to avoid intentionally storing sensitive values that are not needed for bug reports:

• Password input values.
• Text typed into normal input fields.
• Text area content.
• contenteditable content.
• Cookies.
• Full localStorage or sessionStorage dumps.
• Request bodies, response bodies, and request cookies.

Session Replay

Session replay is recorded through rrweb. Replay data can include DOM session data, mouse interactions, scroll activity, and page changes needed for playback. rrweb input masking is enabled with maskAllInputs: true, and the extension also records action logs without typed input values.

Replay data is stored locally in Chrome extension storage and is played back by the local replay viewer bundled with the extension. Replay data is not uploaded to a Bug Black Box backend in this phase.

AI Explain

AI Explain is optional. The extension calls Gemini only when the user saves a Gemini API key and clicks Explain with AI on a report.

When using "Explain with AI", only the specific JavaScript exceptions and related stack traces are sent to the Gemini API endpoint to produce an explanation. Your credentials and full logs are never transmitted. Screenshots and rrweb replay events are not sent by the AI Explain request.

Storage and Sharing

Reports, replay events, screenshots, recording state, and the optional Gemini API key are stored in chrome.storage.local. The user can export a Markdown report. The user controls where exported reports are saved or shared.

Bug Black Box runs 100% locally. We do not host external tracking servers, send analytics, or transmit your session logs.

Privacy & Security

• Sensitive fields redaction Sensitive values (e.g. passwords, bearer authorization tokens, cookies) are automatically redacted locally before any data is exported or analyzed.
• No remote tracking Bug Black Box runs 100% locally. We do not host external tracking servers, send analytics, or transmit your session logs.
• Gemini API transparency When using "Explain with AI", only the specific JavaScript exceptions and related stack traces are sent to the Gemini API endpoint to produce an explanation. Your credentials and full logs are never transmitted.

URL Redaction

Bug Black Box removes URL fragments and redacts query parameter values when parameter names include sensitive terms such as password, token, secret, authorization, cookie, apiKey, or session.

Permissions

The extension uses Chrome permissions only to provide its single purpose: recording browser bug context after explicit user action.

• activeTab and tabs Used exclusively to attach the recorder and sync recording timelines across the tab(s) you select. We do not track background tab activities.
• storage and unlimitedStorage Used to save your local extension state, session replay data, reports, screenshots, and optional Gemini API key locally on your device.
• scripting Used to inject the logging interface to read console warnings, errors, and click sequences.
• webRequest Used to observe request status, failed requests, and timing metadata while recording the tabs you choose.
• Host permissions Used only for pages you choose to record and for the Gemini endpoint when AI Explain is used.

Contact

Use the support contact listed in the Chrome Web Store listing for privacy questions or deletion requests. Local extension data can also be removed by clearing the extension data in Chrome or uninstalling the extension.