Security and data handling

What the widget collects

Nothing is sent until a visitor presses send. When they do, the message carries:

• The page URL, title and referrer, the viewport and screen size, the browser’s user agent string, language and time zone.
• When they pointed at an element: a description of it (tag, text, stable attributes, a selector) and its position on the page.
• When they pointed at an element: a picture of the visible page, rendered in the browser from the page itself. It shows whatever was on screen, so it may include content your visitor could see.
• When they recorded: the screen recording they chose to make, with their microphone if they turned it on. They preview it before sending.
• Whatever identity and context your own code passes through the SDK, if you use it.

What it never does

• No cookies, and no storage that outlives the tab. Pins for comments left during a visit live in session storage and are gone when the tab closes.
• No fingerprinting, no analytics, no session replay, no keystroke capture.
• No changes to your page. The widget draws in its own shadow root and never edits your elements or styles.
• No clicks on your behalf. While a visitor is choosing what to comment on, clicks are intercepted so nothing submits, navigates or pays.

Where the widget may run

Every project has an allow-list of domains. The browser sets the request’s origin and a page cannot forge it, so a request from a domain you did not allow is refused and the widget removes itself. Your project key identifies the project. It is not a secret and grants no access to your dashboard.

Recordings and screenshots

Uploads go straight from the browser to storage using a signed, single-use ticket bound to the exact file size and type. Files are never public. The dashboard serves them only after confirming the person asking belongs to the workspace that owns the thread.

Your account

• Passwords are hashed with scrypt and never stored in the clear.
• Sessions are cookie-based and revocable. Changing your password signs out other sessions.
• Every dashboard request checks workspace membership on the server. Client-side guards are cosmetic.
• The dashboard cannot be embedded in another site. Only the widget may be loaded cross-origin.

Where data lives

Feedoback runs on infrastructure in [Hosting provider and region]. Backups are encrypted at rest. See the privacy policy for retention and your rights.

Reporting a vulnerability

Write to [email protected]. We read every report, reply within three working days, and credit you if you want. Please give us reasonable time to fix an issue before publishing it.