Data and privacy

This page is for administrators and security reviewers. The user-facing policy is the privacy policy.

Where data lives

Everything stays in the browser profile.

Data	Location
Authored content, drafts, versions, assets, app settings	IndexedDB database guidepost (version 1): stores apps, segments, drafts, versions, heads, progress, assets
Settings (author mode, store mode)	storage.local; policy values from storage.managed
Frame registry and picker sessions	storage.session (cleared when the browser closes)
Hint toggle	sessionStorage of the page (decision 71)
Progress per item	IndexedDB progress, keyed by the local user id local

What is not collected

• Nothing is transmitted to any server. There is no backend, and the source of apps/extension and packages contains no fetch, XMLHttpRequest, sendBeacon or WebSocket call (checked with a text search at the time of writing; re-run it before a release).
• The one exception is content you author: a video or documentation link you add loads from its own server when a visitor opens it, as any link would.
• Guidance events (shown, dismissed, step viewed) are produced by the player and sent to the service worker with events.push. The handler discards them. They are not stored.
• Field values are never captured. The recorder stores which field was changed, not what was typed. The locator fingerprint leaves out field values and select options.
• The locator fingerprint keeps short element text (up to 80 characters) and up to three ancestor headings so an element can be found again. The textCapture app flag exists in the schema; nothing in the extension reads it today.

Security rules

From docs/SECURITY.md:

• No remote code. The extension pages use script-src 'self'; object-src 'self'. Every injected file is in the package.
• Every message handler checks the sender (isTrustedSender).
• ContentStore is the only way to read or write content.
• Rich text is Markdown sanitised with DOMPurify.
• The player's shadow root is closed in store builds and open only in dev.
• Documentation links open with noopener; embedded viewers use a sandboxed iframe.
• Imported bundles are validated against the schema before being stored.

Removing data

To remove	Do
One item	Archive it in the studio (asks for confirmation)
All of one app's content	Export a bundle first if you want a backup, then remove the extension's site data
Everything	Remove the extension. Chrome and Edge delete its IndexedDB and storage with it
Progress only	Clear the extension's site data from the browser's extension details

Gotchas

• Content exports contain your locators and the text you wrote. Treat .guidepost.zip files like source.
• A future remote backend would change this page. It is designed to be organisation-controlled and opt-in; see extension seams.
• unlimitedStorage means a large asset library can grow without a browser warning. Check the profile size occasionally.