Legal
Privacy policy
Last updated 15 September 2026
FrontBug is a Chrome extension for reviewing web pages. It records notes about the page you are reviewing, together with screenshots and the browser activity around each note, and lets you export them as a file.
Summary
FrontBug has no user account, no server and no analytics. It makes no network requests of its own. Everything it records stays on your computer, in the browser's local storage, and leaves it only when you export it yourself.
What FrontBug records
FrontBug records nothing until you start a review session on a site, and it records nothing on any site where you have not started one. While a session is running on a site you have granted, it records:
- The notes you write, with their type, severity, tags and status.
- Screenshots of the elements, regions or pages you choose to capture.
- The identity of the element a note is attached to: the markup around it, a selector that can find
it again, its accessible name, its position and size, its computed styles, and, when the site is running a development build that exposes it, the component name and source file.
- The URL and title of the pages you visit within that session, so notes can be grouped by page.
- Console messages and errors produced by that page.
- Network requests made by that page: method, URL, status, timing, size and headers. Request and
response bodies are not recorded.
- Your actions on that page, clicks, typing, form submissions, scrolling and navigation, as
reproduction steps. Text you type into a field is recorded as its length, not its content.
- The display name you choose, or, if you leave "use the account signed into Chrome" on, the email
address of the Google account signed into this Chrome profile. This is used to sign your notes so that a team reviewing the same site knows who wrote what.
- A random identifier generated once for this Chrome profile, so that two people using the same
display name can still be told apart.
- Your settings.
Masking
Because console and network activity can contain credentials, FrontBug masks them before storing them, and this is on by default:
- Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token and Proxy-Authorization headers are
replaced with "<redacted>".
- URL parameters and values whose name suggests a credential, token, secret, key, password, auth,
session, bearer, api-key, access, refresh, are replaced with "<redacted>".
- Values that look like credentials regardless of their name, JSON Web Tokens, long hexadecimal or
base64 strings, are masked. Email addresses are partially masked. Card-shaped and IBAN-shaped numbers are masked.
- Values typed into form fields are recorded as a length. Values in password, email and telephone
fields, and in fields marked as sensitive by the site, are not recorded at all.
Screenshots are not masked. Whatever is on the screen is in the image. Before you export, FrontBug shows you every screenshot in the session and lets you delete any of them.
You can turn individual masking rules off in Settings. Doing so means credentials may be stored in full, on your computer, and may end up in anything you export.
Where it is stored
On your computer, in this Chrome profile, using the browser's local storage for notes, screenshots and logs, and Chrome's extension storage for settings. FrontBug does not use Chrome's synchronised storage, so none of this is copied to Google's servers or to your other devices.
What is transmitted
By default, nothing. FrontBug does not send your notes anywhere unless you ask it to, and it never sends them to us for any purpose of our own. There are three ways data can leave your computer, and all three are off until you turn them on.
Exporting. You get a file, a zip download or a folder written into a project you pick, and what happens to that file is entirely up to you. An export includes your notes, screenshots, the recorded activity, your display name and, unless you turn off "include email in exports" in Settings, your email address.
Connecting to a hub project. If you pair the extension with a FrontBug hub, the notes of the sessions you sync are uploaded to that hub: their text, the screenshots, the recorded activity and your display name. They are stored there so the people in that hub project can see them, which is the point of connecting. Pairing is explicit: you ask for a code, and someone with access to the project has to approve it. You can undo it from Settings, and the project owner can revoke the key from the hub at any moment; from then on nothing more is sent. If you use the hub we run at app.frontbug.com, we are the ones storing that data, and it deletes screenshots, page snippets and recorded activity after the retention period the project sets, 90 days by default. Note text and status stay until someone deletes them.
The local channel. If you turn on "allow local agents" and paste the token, the extension opens a connection to 127.0.0.1 on your own computer, so a coding agent running there can read your notes and ask for a fresh screenshot. That connection never leaves your machine: it is refused for any web page, and the daemon only accepts a token generated on that computer.
Third-party services
None. FrontBug does not use analytics, crash reporting or advertising inside the extension, and does not send your data to any third party. The FrontBug hub is not a third party: it is part of this same product, it is described above, and you decide whether to connect to it.
Sharing
FrontBug does not share your data with anyone, because it does not transmit it anywhere. Your data is not sold. It is not used for advertising, for building a profile, or for anything unrelated to producing your review. No person at FrontBug can access it.
How long it is kept, and how to delete it
Data stays until you delete it. You can delete an individual screenshot, a note, or a whole session from the side panel; deleting a session deletes its screenshots and logs with it. Settings has a "delete all data" action that removes everything. Removing the extension from Chrome deletes its storage as well.
Site access
FrontBug requests access to a site at the moment you start a review on it, one site at a time. It is not granted access to any site at install time. Settings lists every site you have granted and lets you revoke each one, which also stops FrontBug running there.
The Chrome debugger
To photograph a page taller than your screen, FrontBug briefly uses Chrome's developer protocol, which is why Chrome shows a "FrontBug started debugging this browser" banner during the capture. The connection is opened for that one screenshot and closed immediately afterwards. If you dismiss the banner, FrontBug takes the screenshot a slower way instead, and does not reconnect.
This website
The pages on frontbug.com count visits, and that is all. What is sent to our own server is the path of the page, without its query string, the host of the site you came from, and the utm_source of the link if the link carried one. Nothing else.
There is no cookie, no identifier, no browser fingerprint and no third party analytics script. We cannot tell one visit from another or follow anyone between visits. The server keeps only a daily total per page, and not even the time of day.
A click on the install link is counted the same way, because the number of people who install is the only way to know whether this page is useful. It is still a count with nobody attached to it.
We measure this way on purpose. The whole point of the product is that nothing leaves your browser unless you ask, and putting someone else's tracking script on this page would say one thing in the text and another in the code.
Children
FrontBug is a tool for software development work and is not directed at children.
Changes to this policy
If FrontBug's data practices change, in particular, if a future version offers to synchronise your notes to a server, this policy will be updated before that version is published, and any such synchronisation will be something you turn on, not something that happens by default.
Contact
privacy@frontbug.com