This policy explains what data Screshot handles in the Screshot Chrome extension (the "Extension") and on the website www.screshot.com (the "Website"). The short version: capturing, blurring, copying and downloading send no data. If you choose to share a screenshot by link, it is end-to-end encrypted on your device first: we store it, but we cannot see it. The Website uses Google Analytics to measure visits.
1. The Extension
What the Extension does not collect
The Extension does not collect, transmit or store:
- the screenshots you take, unless you choose to share one (see section 3);
- your browsing history, the pages you visit, or what you type;
- usage statistics, analytics, crash reports or device identifiers.
Screenshots are captured by Chrome and edited in a page packaged inside the Extension. When you copy or download one, it goes only to your clipboard or disk. Closing the tab discards the image. The Extension contacts the Website only when you sign in or share a screenshot, and it keeps only your sign-in on your device, in its own storage.
Permissions
The Extension requests the following Chrome permissions, and uses them only for the purpose described:
| Permission | Purpose |
|---|---|
activeTab | Capture the tab in front of you, only at the moment you click the icon or use a shortcut. |
scripting | Scroll the tab you are capturing during a full-page capture, then put it back exactly as it was. |
contextMenus | Add "Capture visible area" and "Capture full page" to the right-click menu on the Screshot icon. |
storage | Keep your Screshot sign-in on this device, in the extension’s own storage. |
identity | Open Google sign-in in its own window when you choose to share, without leaving the editor. |
Pages the Extension opens
- After a manual install, the Extension opens a welcome page on the Website. It does not do this when your organization installs it by policy.
- After you uninstall it, Chrome opens a short survey page on the Website. The address includes the Extension's version number and nothing else.
These pages are part of the Website and are covered by section 2.
2. The Website
Analytics
The Website uses Google Analytics to understand how many people visit, which pages they read and where they come from. Google Analytics uses cookies and collects information such as your approximate location, browser, device and the pages you view. We use this only in aggregate to improve the Website. See our Cookie Policy and how Google uses this data.
Survey answers and forms
If you answer the uninstall survey, the reason you pick and the Extension version are recorded as an anonymous Google Analytics event. If you send the deployment help form, we store what you enter (name, work email, company, team size, topic and message) in Sanity, the content service that runs our blog, in records that are not publicly readable. We use it only to reply and to help with your rollout, and delete it when you ask. Other contact links open your own email app with a message you can review before sending.
Emails you send us
If you email us, we receive your email address and whatever you include in the message. We use it only to reply and to help with your request, and we do not add you to marketing lists.
Former cloud sharing waitlist
We no longer collect waitlist signups. Signups made before sharing launched (an email address and, if given, company name and team size) are kept in Sanity in records that are not publicly readable, and deleted when you ask, or within 12 months after sharing launched.
3. Share by link
Sharing is optional. Nothing below applies unless you sign in and share a screenshot.
End-to-end encryption
When you share, the screenshot and a small thumbnail are encrypted in your browser with a key made for that screenshot. We receive and store only the encrypted files. The key is given only to the people you choose: wrapped for your own account key, wrapped for each person you invite, or placed in a public link after the "#", a part of the address that browsers do not send to us. Your account key is itself stored encrypted, and only your passkey or your recovery code can unlock it. We cannot open your shared screenshots, and we cannot recover them if you lose both your passkeys and your recovery code.
What we store when you share
- Your account: the email address, name and profile picture address from your Google account, and Google's identifier for it. Sign-in uses Google only; we never see your password.
- Encryption keys: your public key, your private key in encrypted form, and for each passkey or recovery code a wrapped (encrypted) copy of the key that unlocks it. None of these lets us decrypt anything.
- Shared screenshots: the encrypted image and thumbnail, and their title, file size, dimensions, sharing mode, dates and view count. Titles start as the captured page's title, and you can rename them. We store the address of the captured page only if you turn that on in Settings.
- Invitations and requests: the email addresses you invite, who invited them, requests for access with their optional message, and, for screenshots shared with invited people, which signed-in invitees opened them.
- Sessions and devices: the browsers and extensions signed in to your account, with a browser and system label (such as "Chrome on Windows") and when they were last used, so you can sign them out.
- Security records: a log of actions on your screenshots (such as a change of sharing mode), and abuse reports made about them. A report can include the reporter's email if they give it, a one-way hash of their IP address, and the screenshot's key if the reporter chooses to send it so our moderators can review the content.
How long we keep it
- Screenshots stay until you delete them. In the trash they are erased after 30 days, or at once with Delete forever.
- Deleting your account (Settings) erases your screenshots, keys, sessions and account at once.
- Sign-in sessions expire after 30 days. Signed-out devices are listed for 30 days, then erased; one-time sign-in codes are erased a day after use or expiry.
- Data erased from our systems can remain in our database provider's backups for a short period before they expire.
Emails we send
When you invite someone, we email them a link on your behalf, with your name or email and the screenshot's title. When someone asks for access to your screenshot, we email you. We also email you if a screenshot of yours is hidden after a report, and to confirm that your account was deleted. We send no marketing email.
Service providers
Sharing runs on: Vercel (Website and API hosting), Neon (database), Cloudflare R2 and Workers (storage and delivery of the encrypted files), Resend (sending the emails above), Upstash (short-lived counters that limit abuse, keyed by account or a hashed sign-in token) and Google (sign-in). They process data only to provide these services to us.
4. Sharing and selling
We do not sell or rent personal data, show advertising, or use your screenshots to train AI. Apart from the service providers named in this policy, we do not share data with third parties, unless the law requires us to.
5. Your rights
Depending on where you live, you may have the right to access, correct or delete personal data about you, or to object to its processing. If you use sharing, you can download a copy of your data and delete your account yourself in Settings on the Website. For anything else, email [email protected]. You can also block analytics cookies in your browser settings.
6. Children
Screshot is not directed at children under 13, and we do not knowingly collect personal data from them.
7. Changes to this policy
If the Extension's permissions or our data handling change, we will update this policy before releasing that change and update the date at the top of this page.
8. Contact
Questions about privacy: [email protected]. For technical details, see our Security overview.