Capture extension privacy

SOPCompass Capture is an optional Chrome extension that records a task you perform in a web app and turns it into draft steps with screenshots.

When it records

• Only while capturing. Nothing is recorded until you press Start capture, and recording stops when you pause or stop. A bar on the page shows while it is capturing.
• Only in the captured tabs: the tab you started in, plus tabs that page opens. Other tabs are ignored.
• Only real clicks. Events generated by a page’s own scripts are ignored, so a page can’t invent steps.
• Only web pages. Browser pages, the Chrome Web Store, PDFs and local files are never scripted or photographed.

What it records

Page addresses are stored as origin and path only. Query strings and anything after # are dropped, and id like path segments (record ids, UUIDs, tokens) become :id.

What it never records

• The values you type. A typing step names the field, never its contents.
• Password, hidden, card number, security code and one time code fields, or any field named like a secret (PIN, API key, SSN, account or routing number and similar). These produce no step, and if one is filled in on screen it is masked in the screenshot, including inside the shadow DOM that apps like Salesforce use.
• Screenshots while a payment form is showing. If a card or bank form from a payment provider (Stripe, Braintree, PayPal, Adyen, Square and others) is on the page, or another site’s frame has focus, the step is saved with no screenshot and a reason.
• Screenshots of a different tab. If you switched tabs just before the shot, no screenshot is taken.
• Your browsing history, cookies or other tabs. The extension doesn’t ask for the tabs, history or cookies permissions.

Email addresses, phone numbers and long digit runs in labels and page titles are replaced with [email], [phone] and [number] in the extension and again on the server.

Important: Screenshots show whatever else is visible on the page, such as customer names in a list. Masking covers credential and payment fields, not everything on screen. Review each screenshot before publishing and delete any you don’t want kept.

How it signs in

• The extension never sees your password or your SOPCompass session.
• You approve it inside SOPCompass, which creates a random 256-bit token, stores only its SHA-256 hash, and hands it to the extension through Chrome’s secure messaging, which only app.sopcompass.com can use.
• The token expires after 8 hours, is kept in memory only (gone when Chrome quits), and can’t be read by scripts on web pages.
• At most five tokens can be live per person. Disconnect in the extension revokes its token, and the app’s capture page can disconnect the extension everywhere.
• Every call re-checks that you are still an editor of the workspace.

Where captures go

Steps and screenshots are sent over HTTPS to your SOPCompass workspace only. A capture stays a draft that only you can open until you publish it. Screenshots are stored in the guide-frames bucket at long random addresses. See Files and storage access.

If you choose Rewrite the wording with AI, that capture’s step text, page titles, addresses and screenshots are sent to Anthropic. See Capture rewrite.

Limits

• 20 captures per person per day, 200 steps per capture.
• Clicks inside embedded frames aren’t recorded.
• Deleting a step deletes its screenshot, unless another step of the same capture uses the identical image. Discarding a capture deletes all its steps and screenshots.