Privacy Policy

1. Overview and single purpose

StepScript is a Chrome extension that records browser interactions initiated by the user and converts the recorded steps into readable Playwright or Cypress test code. This policy explains the information StepScript processes to provide that single purpose.

StepScript has no account system, backend, telemetry, analytics, or advertising service. It does not automatically transmit recorded data to the developer or to third parties.

2. Information StepScript processes

Depending on the actions recorded, StepScript may process:

• browser interactions, including clicks, focus navigation, supported key presses, selections, and changes to form controls;
• full page URLs, including paths, query strings, and fragments, as well as navigation and reload events in the recorded tab;
• page and element details used to describe and locate a target, including visible text, labels, accessible names, element types, identifiers, attributes, and selector candidates;
• values entered in ordinary supported form fields and the final state of selects, checkboxes, radios, range inputs, and color inputs;
• assertions the user explicitly adds for an exact URL, element visibility, or normalized visible element text; and
• technical metadata needed to preserve the flow, such as timestamps, generated step identifiers, schema versions, and recording state.

StepScript does not read file contents, cookies, or the user's general browser history. It observes only the tab and site the user authorizes for the active recording session.

3. How the information is used

The processed information is used only to:

• display and manage the recorded flow in the Side Panel;
• create readable step descriptions and recommended selectors;
• generate Playwright and Cypress test previews;
• copy or download content when the user requests it; and
• resume an active recording after supported page navigation.

4. Local storage, retention, and deletion

Recorded steps and the persistent recording state are stored only in chrome.storage.local in the user's Chrome profile. They are not synced by StepScript or uploaded to an external service.

Recorded steps remain until the user deletes an individual step, uses the clear-all control, or uninstalls the extension. StepScript does not currently apply automatic expiration. Clearing the browser's ordinary browsing history may not delete extension storage.

Short-lived active-tab and element-picker context is held in chrome.storage.session for the browser session. StepScript does not add application-level encryption to locally stored data.

5. Sensitive-data safeguards and limitations

StepScript classifies recognized sensitive form controls before reading their values. Recognized passwords, one-time codes, payment fields, personal identification fields, tokens, and similar secrets are represented only by a protected-value marker and a general reason. The original value, its length, a mask, and a hash are not stored.

This protection is heuristic and depends on the control type and the metadata provided by the website, such as its name, label, autocomplete value, placeholder, or accessible name. It cannot guarantee recognition of every sensitive field.

Ordinary fields such as names, usernames, email addresses, telephone numbers, search inputs, and text areas may be stored as plain values. URLs, selector metadata, visible page text, and user-created text assertions may also contain personal or sensitive information. Users should avoid recording pages or values they do not want retained locally.

6. User-controlled copy, export, and execution

StepScript writes generated content to the clipboard or creates a local test file only after the user selects the corresponding copy or download action. StepScript does not upload those files. If a user later runs an exported test, the test runner and visited websites operate under their own configurations and privacy practices.

7. Sharing and third parties

StepScript does not sell, rent, share, or transfer recorded information to the developer, advertisers, data brokers, or other third parties. It does not use recorded information for advertising, credit, lending, profiling, or unrelated purposes, and it does not permit human access to recorded information.

External links, such as the developer's GitHub profile, are opened only when selected by the user. StepScript does not attach recorded data to those requests.

Public policy hosting

The online copy of this policy is hosted by GitHub Pages. When a user opens that page, GitHub may process ordinary request metadata, including the user's IP address, under the GitHub Privacy Statement. StepScript does not attach recorded steps, captured URLs, selectors, or form values to the request. The copy packaged with the extension can be read without opening the public website.

8. Chrome permissions

activeTab

Identifies the tab explicitly selected for recording.

scripting

Injects the packaged recorder after the user starts recording.

sidePanel

Provides StepScript's primary user interface.

storage

Stores recorded steps, recording state, and transient context.

webNavigation

Detects supported navigation and reload events in the recorded tab and safely resumes the recorder.

Optional website access

Allows StepScript to request access only to the current HTTP or HTTPS site after the user starts a recording.

9. Security

All executable extension code and interface assets are packaged with StepScript. StepScript does not load or execute remote code. Because local extension storage is not application-level encrypted, anyone with access to the user's Chrome profile or device may be able to access locally stored information.

10. User choices

Users control processing by choosing when to:

• grant or revoke access to a website;
• start or stop a recording;
• add a manual assertion;
• edit, reorder, copy, download, or delete recorded steps; and
• clear all recorded steps or uninstall StepScript.

11. Children's privacy

StepScript is a developer and testing tool and is not directed to children. It does not knowingly operate an account system or collect age information.

12. Chrome Web Store Limited Use

StepScript's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. StepScript uses that information only to provide or improve its user-facing recording and test-generation features.

13. Changes to this policy

This policy will be updated when StepScript's data practices change. A material change will be disclosed through the extension interface or Chrome Web Store listing before the new practice takes effect when required.

14. Contact

StepScript is maintained by Gustavo Favero. Privacy questions can be submitted through the StepScript issue tracker.