Privacy policy¶
Effective date: 6 October 2026.
Guidepost is a browser extension for authoring and showing guided tours on web applications. This policy describes what it does with data.
Summary¶
- It collects nothing.
- It sends nothing to the developer or to any third party.
- Everything it stores stays in your browser profile on your device.
What is stored on your device¶
| Data | Where | Why |
|---|---|---|
| Tours, tips, announcements and other content you author, with drafts, versions and uploaded files | IndexedDB, in the extension's own storage | So you can edit and show them |
| Which items you have seen, dismissed or completed | IndexedDB | So tours do not repeat when they should not |
| Settings (author mode, store mode) | Extension storage | To remember your choices |
| Which frames of a tab are open, and active picker sessions | Session storage, cleared when the browser closes | To inject scripts into the right frames |
| Whether hints are shown on a page | The page's sessionStorage |
To remember a toggle for the session |
What it does not do¶
- It does not read or store what you type. Recording a step stores which field you changed, not its value. Element fingerprints leave out field values and select options.
- It does not include analytics, advertising or tracking code.
- It does not run remote code. Every script is part of the installed package.
- It does not collect browsing history. It runs only on sites you have granted access to.
Site access¶
The store build has no standing access to any site. When you choose "Use the open site" in the studio, your browser asks you to grant access to that one origin. You can revoke it at any time in the browser's extension settings. Nothing runs on a site you have not granted.
Importing and exporting¶
A .guidepost.zip bundle contains your content, including element locators and the text you wrote. You control where you save it and who you share it with. Importing a bundle validates it, then stores it locally.
Links you add¶
If you add a documentation link or an embedded video to a tour, the viewer's browser loads it from that link's server when the content is opened. That is the same as following any link.
Future backend¶
A hosted backend is not part of this version. If one is added, it is designed to be controlled by the organisation that deploys it and to be opt-in. This policy will be updated before such a version is released.
Deleting your data¶
Removing the extension deletes its stored data from the browser profile. You can export a bundle first if you want a copy.
Contact¶
Questions about this policy: open an issue at https://github.com/nitin27may/guidepost/issues. For anything sensitive, use a private report through the repository's Security tab.