Last updated 5 September 2026

Privacy

Gotcha is built so that this page can be short. The captures you take never leave the machine that took them, so most of what a privacy policy usually has to explain does not apply.

The Chrome extension

• Your captures stay local. Images and recordings are written to IndexedDB inside your browser profile and are never transmitted anywhere. Deleting them from the library deletes them.
• Your settings stay local. They live in chrome.storage.local, on this machine only — not synced to your Google account.
• No permission on your sites. The manifest declares no host permission. The overlay is injected only after you press the shortcut, under activeTab, and the grant ends with the tab.
• No analytics, no telemetry, no crash reporting. Without a licence key, the extension makes no network request of its own, ever. With one, it makes exactly the two described below — neither of them on the path of a capture.
• One request, and only if you hold a licence. Once a day at most, Gotcha downloads /assets/registry.json from this site: a public, signed list of licence keys that were withdrawn, the same file for everyone. It is a plain GET with no cookie, no identifier and no parameter, and the whole list comes down so that the server is never told which key is asking — the question is answered on your machine. This server keeps no access log. If the request fails, or you are offline, your licence keeps working.
• One activation, once per installation. The first time a Pro key is used on a device, it is sent once to /api/activate along with a random 16-character identifier generated on that device, and comes back as a signed code tying the two together. That is the whole exchange: no captures, no email address you type, no account, no password, no session. Afterwards that installation never contacts us again — the code is checked offline like the key itself. We keep the key identifier, the random identifier and the date, to count how often a key is activated; we keep no IP address and no access log. Agent passes are never tied to a device and make no such call. If your network cannot reach us, the activation page does the same exchange from anywhere else, and can email the code to the address the licence was bought with — an address we already hold, and that you cannot change here.

The command-line tool

• It drives a Chrome on your machine and writes PNG or JPEG files where you tell it to. Nothing is uploaded.
• Sessions and browser profiles live under your cache directory; a saved login state (gotcha save-login) is written to the file you name, and only there.
• A licence key, if you have one, is read from GOTCHA_LICENSE_KEY or from your config directory. It is verified offline, by signature, on every capture — no call is made on that path. The two calls that exist happen only in gotcha activate and gotcha license: the public registry described above, and the one-off activation described below.

This website

• No cookies. No analytics. No tag manager. No third-party script.
• Fonts are served from this server, not from Google — so no request carrying your IP address leaves for a third party in order to draw a heading.
• No access log. Neither the front proxy nor the web server records who asked for what. Errors are logged, because a broken page has to be fixable; they carry nothing about you that is not needed to fix it.

If you buy a licence

• The payment is processed by Stripe. Your card details reach Stripe, never this server.
• We store what a sale requires: the email address you gave, the licence identifier, the plan and the date. That record is kept as long as accounting law requires, then deleted.
• Where an AI agent pays on your behalf through a machine payment, the same applies — with an agent identifier in place of an email address.

If you send feedback

• What you wrote, and nothing else. A message sent from the feedback page or with gotcha feedback is stored on this server and emailed to the person who reads it: the kind, the text, and the context you chose to attach — a page address, a selector, a command line, the version of the tool. No capture, no page content.
• Who you are, only if you say so. If a licence key goes along, we keep the licence identifier and the address it was bought with, so that we can answer. If you give an email address, we keep it for the same reason. Without either, the message is anonymous.
• The one-a-day limit for anonymous messages is counted on a salted fingerprint of your network address, held in memory only and gone within a day — or at the next restart, when the salt changes. The address itself is never written anywhere, and this server keeps no access log.
• What becomes public. Each report is listed on the support & improvements board: its kind, the date it was received, and — once it has been read — a one-line title, a short summary and a decision, all written by the review, with no address and no link in them. The message itself, your email address and your licence are never published.
• Messages are kept as long as they are useful to fix or build what they describe; ask, and yours is deleted.

Your rights

Under the GDPR you may ask for access to, correction of, or deletion of the data above, and you may complain to the CNIL. Write to hello@saastisfaction.com and you will get an answer.

Data controller: Étienne Sanquer, France. Contact: hello@saastisfaction.com.