Privacy Policy

Our approach

7Frames is operated by the provider identified in our Imprint. For privacy questions and requests, use the contact details in our Trust Center.

7Frames is a screen-recording and screenshot tool with an optional cloud service for sharing and collaboration. Capture happens on your device by default; uploading to the cloud is opt-in per capture.

We aim to collect only what we need to provide the service, and we do not sell your personal data or use advertising trackers.

The browser extension (local-first capture)

The 7Frames browser extension captures screenshots and screen recordings on your device. Capture only ever happens on an explicit action you take: starting a screenshot, recording, or bug report. Nothing is captured passively or in the background.

Your screenshots and recordings are stored locally in the browser (IndexedDB) and stay on your device unless you choose to export them or upload them to the cloud. Uploading is opt-in, per capture.

• chevron_rightMicrophone and webcam: accessed when you enable them for a recording, open a camera or microphone setup preview, or run a permission test. Preview and test access lets you check your devices before recording. Audio and video become part of a saved recording when you choose to record with those devices enabled.
• chevron_rightScreen and tab capture: screenshots capture the tab you invoke the extension on. Recordings use the current tab or the window or screen you select, depending on the capture mode. Website permissions allow capture helpers and recording controls to work on supported pages; they do not mean that screenshots or recordings are taken without your action.
• chevron_rightCapture metadata and interactions: screenshots, recordings, guides, and bug reports can include page URLs, page titles, capture times, and browser and device details. During a recording, guide, or bug report you start, they can also include navigation events, clicks, cursor positions, scrolling, the labels or visible text of elements you click and, for guides and bug-report timelines, short excerpts of text you type into form fields. Guides also save a screenshot of the visible tab at each step. Password, payment, and other recognised sensitive fields are skipped or masked, but this filtering is not guaranteed to catch every sensitive value. This information supports capture organisation, motion effects, guides, and debugging. It is stored locally with the capture and relevant metadata or interaction evidence may accompany content you choose to upload or export. We do not collect your complete browser history for unrelated tracking or advertising.
• chevron_rightDeveloper Bug Report (optional): every advanced section is off by default. When you turn them on, a report can include console logs, network logs / HAR (request URLs, methods, redacted headers, status codes, sizes, and timing; request and response bodies are never captured), a local/session-storage snapshot, and a user-action timeline. The optional “Advanced Dev Logs” mode uses Chrome’s debugger interface, which the extension requests only at that moment, attaches only to the tab you are reporting, and detaches as soon as the capture ends.
• chevron_rightOn-device transcription and captions: if you generate captions in the extension, a small speech-to-text model file is downloaded once from a third-party CDN (Hugging Face). Your audio is transcribed locally in the browser and is never uploaded for this. Only the model itself is fetched.
• chevron_rightRedaction tools: structured bug-report data is filtered for supported sensitive patterns, such as authentication headers, tokens, and secret-named fields. Separate screenshot tools can detect text and apply blur, pixelation, or solid masks when you use them. These tools do not guarantee removal of every sensitive detail from images, video, audio, or text. Review your capture and report before exporting or sharing; do not assume that the entire recording has been automatically sanitised.
• chevron_rightSign-in and connected services: the extension stores your 7Frames account profile and access and refresh tokens in local extension storage to keep you signed in. Credentials for cloud-connected third-party integrations are stored encrypted on our server, as described below. Uploading or sending a report uses the cloud service and the destination you select.
• chevron_rightAccount activity: while you are signed in, actions such as opening the extension popup or starting a recording send a limited activity signal to our service to update your account’s last-active timestamp. This signal does not contain the screenshot, recording, or a list of pages you visited. Other cloud requests authenticate your account and synchronise settings and feature access. We do not use these signals for advertising or cross-site profiling. Executable extension code is bundled in the extension package.

Information we collect

• chevron_rightAccount information: your email address, name, and authentication details (passwords are stored only as secure hashes).
• chevron_rightSecurity and service activity: sign-in IP addresses, browser or device information, session records, and account activity timestamps. We use these for session management, account administration, security notifications, abuse prevention, and operating the service. These account-security records are separate from the viewer-analytics records described below.
• chevron_rightContent you create or upload: recordings, screenshots, titles, descriptions, and related metadata, plus any transcripts, AI-generated chapters or summaries, comments, and reactions tied to them.
• chevron_rightSharing and viewer analytics: when you share a recording, we record engagement for you as the owner, including page views, qualified view counts, watch progress, and playback events such as play, pause, and seek, together with the referring page. In these analytics records, viewer IP addresses and browser user-agents are represented by salted hashes rather than raw values. To count unique viewers, we also store a persistent anonymous identifier in the viewer’s browser, a hashed viewer fingerprint derived from it, and, if the viewer is signed in to 7Frames, their account ID. Workspace owners and admins can see how many recordings each workspace member has watched, and whether people invited by email to a share have watched it. This does not describe the separate sign-in and security records above.
• chevron_rightBilling information: if you subscribe, Stripe handles your card details. Our service handles billing contact information, customer and subscription identifiers, subscription status, invoice amounts, and payment status to manage your subscription and display billing history. We do not receive full card numbers.
• chevron_rightSupport and request information: details you provide when you contact us (for example through our Trust Center or a support request).

Cookies, browser storage, and website measurements

7Frames uses essential browser storage to sign you in, keep your session secure, and remember preferences such as your light/dark theme and playback quality. When you open a shared recording, the page also keeps an anonymous viewer identifier in your browser storage, which is used for the owner’s viewer analytics and to attribute your comments and reactions. We do not use advertising or cross-site marketing cookies.

Our website, including the signed-in app, loads Cloudflare's measurement beacon to measure website performance and usage. The beacon is blocked on share links, embeds, docs, request links, invite and join links, and password-reset pages, so those pages do not send measurements to Cloudflare. On other pages it sends website measurement data to Cloudflare, including page views, page and referrer URLs, and page-load and responsiveness timings. These measurements are separate from the recording-owner viewer analytics described above. See Cloudflare's beacon documentation for the data fields and processing details.

Our public website pages (home, features, AI, pricing, compare, the legal pages, the Trust Center, support, sign-in and sign-up) also send cookieless page-view statistics to a Plausible Analytics instance that we host and control. For each page view it receives the page path, the referrer, any campaign source parameters, and your browser user-agent and IP address, which it uses to derive the browser, operating system, device type and approximate country, and to count unique visitors with a salted identifier that changes daily. Plausible does not set cookies or store your IP address. Plausible does not measure the signed-in app, admin pages or shared recordings (the Cloudflare measurement described above is separate).

How we use your information

• chevron_rightTo provide, maintain, and improve the service.
• chevron_rightTo process recordings you upload, including automatic transcripts, chapters, and summaries when the relevant service configuration and plan allow them, and guides or other AI results you request.
• chevron_rightTo enable sharing, comments, reactions, and owner-facing viewer analytics.
• chevron_rightTo send account, security, and product notifications, and to respond to your requests.
• chevron_rightTo process payments and manage subscriptions.
• chevron_rightTo keep the service secure and reliable, including rate-limiting and error monitoring.

Chrome Web Store Limited Use

For user data obtained through the extension, we follow the Limited Use requirements of the Chrome Web Store User Data Policy.

We use data obtained through the extension only to provide and support its disclosed capture, editing, recording, reporting, documentation, and sharing features, including necessary security and reliability operations. We do not sell this data, use or transfer it for personalised advertising, or use it to determine creditworthiness or for lending.

Transfers are limited to providers needed to deliver or support these features, legal obligations, and security or abuse prevention. Any transfer as part of a merger, acquisition, or asset sale will require explicit prior consent where required by the Chrome Web Store policy.

We permit staff or service-provider personnel to access user content only with explicit consent for specific content, where necessary for security or legal obligations, or when the data is aggregated and anonymised for internal operations as permitted by the policy.

Sub-processors and sharing

We use third-party service providers for application and database hosting, object storage, payment processing, optional AI processing, email delivery, optional third-party sign-in, and website performance and usage measurements. Several apply only when you use the related feature. Cloudflare receives the website measurements described above. Our Trust Center lists the providers, their purposes, and the data involved.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

Third-party workspace integrations

With your explicit permission, you can connect 7Frames to Slack, Jira, Confluence, Linear, GitHub, or Notion so you can push a generated document (for example a bug report or guide) into your own workspace. You can authorize a connection through the provider’s own OAuth sign-in screen where one is available or, if you prefer, by pasting an API token or key you create in that provider’s settings (for Jira and Confluence this includes your Atlassian account email). We never ask for, see, or store your provider password.

• chevron_rightWhat we read: only what’s needed to confirm the connection and let you pick a destination - your account identity, and the names of your Slack channels, Jira projects, Confluence spaces, GitHub repositories, Linear teams, or Notion databases the integration can see. We do not read the existing content of your messages, issues, pages, or docs.
• chevron_rightWhat we write: only when you choose to push a document, we create a new Slack message, Jira issue, Confluence page, GitHub issue, Linear issue, or Notion page from content generated in 7Frames, plus any files you attach. This is one-way - we do not fetch or store the resulting content afterward, only a link back to it.
• chevron_rightCredential storage: your OAuth access token (and refresh token, where the provider issues one) and any API token or key you paste are encrypted at rest with AES-256-GCM using a server-only key, and are never returned to your browser or written to a log.
• chevron_rightDisconnecting: disconnecting an integration from your workspace or personal settings removes its credential from the active integration records and stops 7Frames from using that connection. Documents already sent to the destination remain subject to that service’s controls and retention settings.

AI processing

Uploading a video starts automatic chapter and summary processing, and transcription when configured. The available AI processing depends on the service configuration and your plan; a separate Generate action is not required for these upload-triggered features. Guide generation and other AI tools process the uploaded content you select. Processing may involve an AI sub-processor listed on our Trust Center. Transcription can be self-hosted, in which case audio is processed on our own infrastructure.

Cloud AI processing may send the selected uploaded media, extracted audio or images, transcripts, and relevant text or interaction metadata to the configured processor as needed for the requested feature. This is separate from the on-device caption generation described above.

Data retention and deletion

We retain your content and account data for as long as your account is active or as needed to provide the service. You can delete individual recordings at any time. You can also delete your account and its cloud recordings from the in-app Privacy Center; if you own a team workspace, delete it first. Deleting your account cancels any active paid subscription immediately, without a prorated refund, and does not automatically remove every stored record: for example, billing identifiers and connected-integration credentials are kept, so disconnect your integrations first.

You can download a self-serve, portable JSON copy of your data at any time from the in-app Privacy Center. It includes your account profile, recordings and their transcripts, chapters and summaries, share links, comments, saved items, workspaces, and notification settings; your media files stay in your library and secrets are never included. Very large accounts may receive a capped export; contact support for a complete copy.

Deleting a recording moves it to Trash and, after a 30-day recovery window, permanently removes the original media together with its derived files (processed video, thumbnails, captions, transcripts, AI summaries, chapters, and translations) from object storage, and revokes its share links. Temporary artifacts from failed uploads or renders are cleaned up in the background.

Cloud deletion does not remove separate copies in your extension’s local library, files you downloaded, or documents you sent to another service. Manage those copies in the local library, on your device, or with the destination service.

Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can export your data and delete your account directly in the app, and you can make other requests through our Trust Center contact options. We will respond consistent with applicable law.

International transfers

Some of our sub-processors are based in the United States, so your information may be processed there. These transfers rely on the data-processing and international-transfer terms each provider makes available. See the Trust Center for the providers involved and for current Data Processing Agreement availability, or email [email protected] with transfer questions.

Security

We use measures appropriate to the service, including hashed passwords, optional two-factor authentication, private media storage served via short-lived signed links, encryption of connected third-party integration tokens, and rate-limiting on sensitive endpoints. No method of transmission or storage is perfectly secure, but we work to protect your information and review our practices over time.

Uploaded media - recordings, screenshots, thumbnails, and derived files - is stored in a private, S3-compatible object store (Cloudflare R2) and encrypted at rest with AES-256 using provider-managed keys. Customer-managed encryption keys are not currently supported. Traffic is protected in transit with TLS. See the Trust Center for the encryption and sub-processor details.

Children

7Frames is intended for use by adults and is not directed to children. You must be old enough to form a binding contract in your jurisdiction to use it. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you.

Contact us

For privacy questions or to exercise your rights, email [email protected]. To report a security issue, email [email protected]. You can also use the contacts in the 7Frames Trust Center. Our Imprint identifies the service provider and its legal contact details.