What we collect

We do not receive your screenshots, recordings, edits, browsing activity or the pages you capture. The only information we hold is what is needed to run Pro licences (see Licences) and the optional answer you may leave on the goodbye page (see Welcome and goodbye pages).

Where your data lives

• Captures, recordings, edits, step guides and history are stored in your browser's local storage (IndexedDB) on your device.
• Settings and preferences are stored in Chrome's extension storage. Settings kept in Chrome's synced storage are synced across your own signed-in Chrome profiles by Chrome itself if you use Chrome Sync. That sync is handled by Google, not by us.
• Credentials you enter (webhook addresses, access tokens and AI API keys, see below) are kept in extension storage on this device only. They are not synced and not sent to us.
• You can delete any item, or clear everything, from the extension at any time.

On-device AI features

These features run locally in your browser and upload nothing:

• Transcription and subtitles (Whisper) for recordings.
• Text extraction (OCR) and QR reading from images.
• Camera background blur for the webcam bubble during recording.

What leaves your device, only when you choose

Lumashot sends your content to a third party only when you use one of the features below, and only to the service you pick. We do not receive any of it. For services that need a web address, Chrome asks you to grant Lumashot access to that address the first time you use it. Each service handles what you send under its own privacy policy.

• Share link. Lumashot encrypts the file in your browser (AES-GCM) and uploads the encrypted file to tmpfiles.org. The decryption key is placed after the # in the link, which browsers do not send to the server. Anyone who has the full link can open the file, so share it only with people you trust. How long tmpfiles.org keeps the file is up to that service.
• Google Drive or Dropbox. You sign in through Google or Dropbox in a Chrome sign-in window. Lumashot uploads the file to your account and creates a link that anyone with the link can view. For Google Drive it requests only the drive.file scope (files Lumashot itself creates) and uses a folder named "Lumashot". For Dropbox it requests permission to write files and create shared links. The access token is kept in Chrome's session storage and is cleared when the browser closes, and signing out revokes it.
• Send to Slack, Discord, GitHub, Trello, Notion, Jira or Linear. You enter your own webhook address or access token for the service (and, where needed, details such as a repository, channel or list). Lumashot then sends the capture image to that service together with a title and note, and the address of the captured page when it is included in the message. For GitHub, a capture is added to a secret gist and an issue is opened in the repository you name. These credentials are stored on this device only.
• AI text for step guides (OpenAI, Anthropic or Google Gemini). This is off until you add your own API key. When you ask for AI text, Lumashot sends your step labels, and a downscaled screenshot of the step only if you turn that option on, to the provider you chose, using your key. Page addresses are not included. For OpenAI-compatible providers you can set a different endpoint, and then the data goes there instead. Your key is kept on this device only.

Developer bug capture (optional, off by default)

If you explicitly enable Developer bug capture and opt in for a capture, Lumashot collects the page's console logs, network request metadata (URLs, status, timing; not request or response bodies by default), and environment info (URL, browser, viewport) and stores them locally alongside that capture, so you can export a bug report. This data is never transmitted by us. The feature is off until you turn it on, and it requires your permission to access sites.

Licences

Free features work without any account or any connection to us. Pro features are unlocked by a licence key you receive from Gumroad after buying. When you activate a key, and afterwards in the background, Lumashot contacts our licence server at lumashot-license-server.omaniapps.workers.dev.

• What the extension sends: your licence key and an anonymous, randomly generated install ID. The install ID is stored on this device, and Chrome may also keep a copy in your synced storage so a reinstall on the same Chrome profile reuses the same seat. No screenshot, recording, page address or other content is sent.
• What the server stores: the install ID, your licence key, the email address on the Gumroad purchase, your plan and its end date, a last-updated time, and which install IDs have used a key (to enforce the limit of 3 devices per key). Nothing else.
• How it is checked: the server confirms the key with Gumroad and returns a signed token that the extension verifies on your device. A token lasts 30 days for an active paid membership or a lifetime licence, and about 24 hours during the Gumroad free trial or after a membership has been cancelled. Lumashot checks in the background on browser startup and about every 6 hours, and asks the server for a new token only when the current one is close to expiring.
• Offline: if the server cannot be reached, Pro keeps working until the current token expires.

Payments

Purchases are sold and processed by Gumroad (gumroad.com), which is the merchant of record. Checkout happens on kitshore.app/lumashot/upgrade/, which opens Gumroad's checkout overlay. Your payment details are handled entirely by Gumroad under its own privacy policy. We never see or store your card details.

• Monthly ($2.99) and yearly ($12) memberships start with Gumroad's 7-day free trial. A card is required, it is charged when the trial ends unless you cancel first, and Gumroad emails you before then.
• Lifetime is a one-time payment of $19.99.
• Purchases are final.

Welcome and goodbye pages

When you install Lumashot, it opens a welcome page on kitshore.app/lumashot/welcome/ in a normal tab. When you remove it, Chrome opens a goodbye page at kitshore.app/lumashot/goodbye/. These are ordinary web pages your browser loads and you can close. Their address carries only the Lumashot version and your interface language (for example ?v=3.8.3&lang=en). No install ID, licence key or other personal data is included.

The goodbye page has an optional feedback form: a reason, an optional message and an optional email address. If you submit it, Kitshore's feedback service stores your answers together with the product, version and language. Your IP address is not stored. It is used only as a salted hash for rate limiting, and those hashes are deleted after 24 hours. If you do not submit the form, nothing is sent.

Permissions and why Lumashot needs them

Granted at install:

• activeTab, scripting: to capture and annotate the page you choose.
• storage, unlimitedStorage: to keep your captures, settings and local licence data on your device.
• downloads: to save your exports to your Downloads folder.
• contextMenus: to add Lumashot to the right-click menu.
• offscreen: to run recording and on-device processing in a background page.
• notifications, clipboardWrite: to notify you when a capture is ready and to copy an image to your clipboard.
• alarms: for scheduled captures you set up and the background licence check.
• identity: only for the Google Drive and Dropbox sign-in window when you choose those options.
• debugger: for pixel-perfect full-page capture and device-size emulation. Chrome shows a banner while it is attached.

Optional, requested only when you use a feature that needs them:

• tabs, tabCapture: to read tab details for features that work across several tabs and to record a tab.
• Access to all sites (<all_urls>): for features that work across pages, such as full-page capture and, if enabled, developer bug capture.
• Our licence server and Gumroad: lumashot-license-server.omaniapps.workers.dev and api.gumroad.com, for licence checks.
• Services you send to: tmpfiles.org, Slack (hooks.slack.com, slack.com), Discord, GitHub, Trello, Notion, Jira (*.atlassian.net), Linear, OpenAI, Anthropic and Google Gemini. Each is requested only when you set up and use that service.

Data sharing

We do not sell or rent your data, and we do not share it with anyone for advertising. We receive no captures. Data reaches a third party only in these cases: Gumroad processes your purchase, our licence server checks your licence, and the services you choose to send content to (described above) receive what you send them.

Chrome Web Store User Data Policy

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Lumashot uses data only to provide and improve its single purpose of capturing, recording and annotating. It does not transfer or sell data to third parties other than as described in this policy, does not use it for advertising, and does not use it to determine creditworthiness or for lending.

Your choices and deleting your data

• Delete any capture, or clear everything, from inside the extension. Removing the extension deletes the data it stores locally in your browser.
• Revoke any optional permission at any time in Chrome's extension settings.
• Files you sent to other services (a share link, Drive, Dropbox, Slack, GitHub and so on) are kept by those services, so delete them there.

Children

Lumashot is a general-purpose productivity tool and is not directed at children under 13. We do not knowingly collect personal information from children.

Changes

If this policy changes, we will update the date above and the version published with the extension.

Contact

Questions about privacy?