Privacy Policy — Claudia

In short: Claudia stores all workflow and recording data locally on your device. We do not collect, transmit, or store any of your browsing data, recordings, or screenshots on external servers. The only external communication is license key validation and device-limit enforcement with our license server and payment processor (LemonSqueezy).

1. Data Collection

What we collect: When you activate or validate a license, your license key, a randomly generated device identifier, and a non-reversible device fingerprint hash (derived from browser type, screen resolution, language, and timezone) are sent to Claudia's license server for validation and device-limit enforcement. No browsing data, recordings, or personal information is included in this request. All recorded steps, screenshots, URLs, form inputs, and session data are stored exclusively in your browser's local IndexedDB storage.

What is captured locally during recording: When you start a recording session, Claudia captures clicks, form inputs, page navigation, and screenshots on your device. This data is stored locally in your browser's IndexedDB and is not transmitted to any server. (License activation and periodic re-validation send a device identifier and license key to Claudia's license server — no recording or workflow data is included.)

What we do NOT collect or transmit externally:

closeBrowsing history
closeScreenshots, page content, or recordings (stored locally only)
closePasswords (auto-redacted before storage)
closeAnalytics, telemetry, or usage tracking

2. Data Storage & Encryption

All recording data (steps, screenshots, sessions) is stored locally in your browser using IndexedDB. This data does not leave your device unless you explicitly export it. (License activation and re-validation send a device identifier and license key to Claudia's server — see Section 7 for details — but no recording or workflow data is included in these requests.)

→Encryption at rest: All step data is encrypted using AES-256-GCM via the Web Crypto API before being written to IndexedDB.
→Ephemeral key storage: The encryption key is stored in chrome.storage.session (memory-only) and is automatically cleared when the browser is closed.
→No cloud backup: Claudia does not sync or replicate your recording or workflow data to any server.

3. Sensitive Data Redaction

Claudia automatically detects and redacts sensitive information before it is stored:

→Password fields: Any type="password" input is replaced with [REDACTED] — the actual value is never captured.
→Credit card numbers: Detected via pattern matching and replaced with [CARD REDACTED].
→Social Security Numbers: Detected via pattern matching and replaced with [SSN REDACTED].
→API keys & tokens: Common key patterns (sk_, pk_, bearer tokens) are detected and replaced with [API KEY REDACTED].
→Sensitive field detection: Fields with autocomplete hints (cc-number, cc-csc) or names containing "password", "secret", "token", etc. are fully redacted.
→Payment page screenshot toggle: Enable "Skip screenshots on payment pages" in Settings to prevent screenshots from being captured on checkout, payment, and billing pages (PCI-DSS compliance).
→Export redaction: Optionally redact all typed values when exporting, and sensitive URL query parameters (tokens, API keys, session IDs) are automatically stripped from exported files.

4. Consent

A consent dialog is displayed before every recording session, disclosing what data will be captured. Recording does not begin until you explicitly confirm. You can stop recording at any time.

5. Desktop Recording (Optional Add-on)

Claudia offers an optional desktop monitoring add-on that captures mouse clicks, window switches, and screenshots outside the browser. This feature:

→Is disabled by default and requires explicit opt-in.
→Runs as a local Python process via Chrome Native Messaging — no data is sent externally.
→Suppresses keystroke capture in sensitive windows (login screens, payment forms, password managers).
→Can be uninstalled independently of the Chrome extension.

6. Chrome Extension Permissions

Claudia requests the following Chrome permissions:

Permission	Purpose
tabs / activeTab	Detect page navigation and capture screenshots of the active tab during recording
storage	Store session data, user settings, and license information locally
sidePanel	Display the live recording view alongside the page
downloads	Export recorded SOPs as downloadable files
alarms	Schedule automatic deletion of expired sessions and keep the service worker alive during recording
nativeMessaging	Communicate with the optional desktop recording companion app
host_permissions	Record actions on any website you visit during a session

7. Third-Party Services & Payment Data

Claudia uses one third-party service for payment processing:

→LemonSqueezy: Used for license key validation and payment processing. When you purchase a license, LemonSqueezy processes your payment information (email, name, payment method). No browsing data, recordings, or workflow content is shared with LemonSqueezy. See LemonSqueezy's privacy policy.
→No other third parties receive workflow, recording, or browsing data from Claudia. The landing site (claudiasop.com) uses Google Analytics for aggregate traffic measurement; no personal data from recordings is included in analytics.

License validation & device management: License activation and periodic re-validation are processed through Claudia's server, which communicates with LemonSqueezy on your behalf. Claudia stores your license key, a random device identifier, a non-reversible device fingerprint hash, and the timestamp of each validation check to enforce per-license device limits and detect unauthorized key sharing. Purchase and license information (email address, plan type, license key, and order status) is also mirrored from LemonSqueezy for service continuity.

Important distinction: Only payment and licensing data is stored on Claudia's infrastructure. Your workflow recordings, screenshots, form inputs, and all SOP content are designed to remain stored exclusively on your local device and are not transmitted to Claudia's servers or any third party.

8. Data Retention & Deletion

→Configurable retention: Auto-delete recordings after 30, 60, 90, 180, or 365 days, or keep forever (default: 90 days). Configurable in Settings.
→Manual deletion: Delete individual sessions from the session list, or use "Delete All Data" in Settings to erase all sessions, steps, and audit logs at once (GDPR right to erasure).
→Uninstall: Uninstalling the extension removes all local data from your browser.
→Clear site data: You can also clear all extension data via Chrome's "Clear browsing data" settings.

9. Children's Privacy

Claudia is not directed at children under 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. Continued use of Claudia after changes constitutes acceptance of the revised policy.

11. Contact

For questions about this privacy policy: