Recorder privacy

Last updated: 2026-04-19. Applies to: the VikingQA Recorder browser extension (Chrome Web Store listing name VikingQA Recorder).

Overview

The VikingQA Recorder lets QA engineers and product teams record browser sessions and replay them as automated tests. This document lists exactly what the extension collects, stores, and transmits, and what it does not.

Data the extension collects

When you are actively recording a session on an origin that your organization's project allowlist permits, the extension captures:

User interactions — click targets, typed text (sanitized — see below), file-upload metadata (filename + byte size, never the file contents), keyboard events, and page-navigation events.
Timing data — millisecond timestamps for each interaction.
Selectors — CSS-style selectors computed at record time so the test can replay against the same element.

It does NOT capture:

Passwords, credit-card-shaped values, API keys, or fields marked with autocomplete="current-password" / autocomplete="new-password". These are redacted client-side before they ever leave the page, via the credential sanitizer. A startup self-test fails the recorder closed if the sanitizer is not operational — recording is refused in that state.
DOM snapshots of pages you are not actively recording.
Traffic from tabs or windows outside the project allowlist. The debugger attach is gated on the active tab's origin being allowlist-approved by your project admin.
Any activity outside an active recording session. The extension does not observe, log, or transmit anything while idle.

Data transmitted to VikingQA servers

When you save a recorded session, the extension sends (over authenticated HTTPS):

The sanitized VikingScript (the sequence of actions you recorded, minus the redacted credential fields).
An org- and project-scoped identifier for your session.
Telemetry events — anonymized metrics about recording lifecycle, errors, and performance. The full list of telemetry events, enumerated verbatim, is in the schema at apps/app/src/server/modules/recorder/telemetry.schema.ts. Telemetry events are a restricted discriminated union whose variants enumerate every legal payload; selectors, URLs, DOM content, and sanitizer payloads are structurally absent from the schema so they cannot be transmitted.

The extension does NOT transmit:

Credentials of any kind. See the sanitizer description above.
CSS selectors, URL paths beyond their origin, or DOM snapshots in telemetry events.
Personally identifying information beyond your VikingQA account identifier (which is already associated with your account).

Data stored locally

The extension uses chrome.storage.session to persist the current recording draft across service-worker wake cycles. This store is:

Cleared on every browser restart (per Chrome's design).
Never written to disk outside Chrome's sandbox.
Inaccessible to content scripts on web pages.

The extension uses chrome.storage.local for:

Your recorder authentication bearer token (stored after OAuth flow).
Your selected environment (local/dev/prod — dev-only build).

Clearing your Chrome profile or uninstalling the extension removes all locally stored data.

The extension does not share any captured data with third parties. Data flows only between:

Your browser (where the extension runs).
VikingQA's servers (where test data is stored under your organization's account).
Anthropic, Google, or OpenAI (only when your organization has configured AI-assisted features — semantic assertion evaluation or intent inference — and only with your organization's API keys / consent).

Data retention

Recorded scripts are retained for the lifetime of your scenario in your organization's account. Delete a scenario to delete its history.
Telemetry events are retained for 90 days in the server-side observability backend.

Your rights

You can export your recorded scenarios via the VikingQA web app.
You can request deletion of your account and all associated data by contacting support@vikingqa.io.
You can uninstall the extension at any time; uninstalling removes all locally stored data.

Contact

For questions about this policy, contact privacy@vikingqa.io.

This policy is committed in the VikingQA monorepo and versioned along with the extension code. Changes require a PR + legal/compliance review before an extension update is shipped.