Zoxo — privacy policy
Zoxo is a screenshot and screen-recording extension for internal QA use, by Tushar Mali. Last updated 27 August 2026.
What stays on your computer
Everything you capture:
- screenshots (visible area, full page, selected area, element, desktop)
- screen, tab, camera and microphone recordings
- edited images, exported videos and GIFs
- thumbnails and in-progress recording chunks
These are stored in the browser’s own local database (IndexedDB) belonging to the extension. They are readable only by this extension, on this machine, in this Chrome profile. No code path in Zoxo uploads them anywhere. Files leave the browser only when you choose Download, at which point they go to your own Downloads folder.
Deleting a capture in the library, or “Delete everything” in Settings, removes it permanently. Uninstalling the extension removes the whole database.
What can be sent to your team
If — and only if — an endpoint has been configured in Settings, Zoxo sends one small row per action to your own organisation’s Google Sheet:
| Field | Example |
|---|---|
| Email address and name | asha@company.com — identifies the tester in their own team's sheet |
| Device id | a random id generated when the extension is installed |
| OS, browser and extension version | Windows, Chrome 130, 1.0.3 |
| Event name | capture.fullpage, record.stop, export.download … |
| Capture mode | fullpage, tab, screen+camera … |
| Page address | shop.example.com/checkout — never the query string or fragment |
| Page title | Checkout |
| Size, dimensions, duration | 482113 bytes, 1440x5200, 42000 ms |
| Timestamp | 2026-08-25T10:14:22.104Z |
That is the complete list. No pixels, no audio, no page content, no form values, no cookies, no browsing history.
Page addresses
Query strings and URL fragments are always removed before a row is created, because they routinely carry session tokens. Each tester can reduce this further in Settings:
- Host + path (default) — shop.example.com/checkout
- Origin + path — https://shop.example.com/checkout
- Host only — shop.example.com
- Off — no address recorded at all
Turning it off
Settings → Team activity log → untick Send activity rows to the team sheet. Every capture and recording feature keeps working exactly as before.
Permissions, and why each is needed
| Permission | Why |
|---|---|
| activeTab, tabs, host access | Take the screenshot of the page you are on and read its size |
| scripting | Inject the area picker, the scrolling-panel picker and the recording controls on demand |
| tabCapture | Record the current tab |
| offscreen | Keep a tab recording alive while you navigate |
| storage, unlimitedStorage | Keep your settings and your captures on this machine |
| downloads | Save a capture to your Downloads folder when you ask |
| identity, identity.email | Read your Chrome profile email so you do not have to type it |
| notifications | Tell you when a long capture finishes or fails |
| contextMenus, alarms, clipboardWrite | Right-click menu, sending queued rows, Copy |
Zoxo contains no analytics SDK, no advertising code and no third-party scripts, and makes network requests to exactly one place: the endpoint your own administrator configured.
Third parties, selling and sharing
None, never, and no. Activity rows go to a Google Sheet owned by your organisation, via your organisation’s own service account. Data is not sold, not used for advertising, not used to assess creditworthiness, and not shared with anyone else.
Children
Zoxo is a workplace tool and is not directed at children under 13.
Contact
Questions, or a request to remove your rows from a sheet: tusharmali197@gmail.com.