Privacy policy

Last updated: 14 August 2026.

This policy covers three separate things:

• The Itra extension, which records and replays guides in your browser.
• The Itra console at console.itra.app, and the public guide pages at share.itra.app.
• The Itra website at itra.app, which you are reading now, and the feedback form on it.

It does not cover the websites you record on, or the websites shown in a guide. Those have their own policies.

How Itra fits together

The extension records what you do on a web page while you narrate it, and turns it into a how-to guide. It does that on your computer.

The console is a separate website, with an account, where a guide can be hosted and given a public link. You register for it yourself, and you can use the extension to record, replay and export without ever doing so.

The two are joined only when you pair them, and pairing starts on the console: you sign in there, and the console hands the extension a connection token for your account. Until you pair, the extension has no account and nothing it records can reach Itra. After you pair, a guide reaches the console only when you upload one.

The Itra extension

This part describes what the extension records in your browser, where it keeps it, and what can leave.

Recording, replaying and exporting need no account and no sign-in. The extension creates no user ID or device identifier of its own, and collects no analytics.

What Itra records, and only while you are recording

Itra runs on every page you open, and does nothing on any of them until you start a recording. Once you do, on the tab you chose, it records:

• Page addresses. The address of the page you start on, and the address of any page you reach from the address bar, a bookmark, or a route change the site makes itself. An ordinary link click is recorded as the click, not as a second address.
• Clicks and double clicks. A way to find the element again, its visible label or text (up to 120 characters), what kind of element it is, and where it sat on the page.
• Callouts. When you use Callout, Itra stores the page address, the exact path to the element you selected, its label and position, your note or element check, and a short piece of that element’s HTML. It takes the screenshot only when you press Save.
• Values you enter. The final contents of a text field once you leave it, and the state of a dropdown, checkbox or radio button when you change it. Not the keystrokes that got you there.
• Drag and drop. The item you dragged and where you dropped it.
• Some keypresses. Enter, Escape, and shortcuts held with Ctrl, Alt, Shift or Cmd. Plain typing, Tab and the arrow keys are never recorded.
• Where an embedded frame was. A page can embed another site inside it. When the thing you act on is inside one, the step also stores the way to find that frame on the page - the frame elements from the top of the page down to the document you acted in. Positions and the way to find them, not the frame’s contents.
• Values of page variables you chose to watch. Before you start, you can name page variables such as adobeDataLayer. After each step, Itra reads those variables and stores what changed. A variable that is missing is recorded as not present and does not fail the step.
• Screenshots. A JPEG of the visible part of the tab, taken as each step happens, with the element you are acting on outlined.
• Your narration, if narration is switched on. The guide audio pauses throughout Callout mode; pressing Record narration captures one temporary clip for that Callout note instead.
• The size of your browser window, so a replay can reproduce it.
• Your browser and system, once per capture. The browser’s name and version, the operating system’s name and version, and the window size - read from the browser’s client hints, never from the full user-agent string. Not your language, and not your timezone: neither is collected. Itra stores this with the capture and shows it nowhere. It leaves your computer only inside an export, and only when you switch Browser and OS info on.

Itra records nothing on a tab you are not recording. While a recording is paused, it records no page actions or screenshots; a Callout box that was already open can still save its note or check.

One thing happens outside a recording. Itra reads the address of the tab you are looking at so it can show you a count of the recordings you already made for that page. It compares the address in memory and stores nothing.

Where it is stored

Everything the extension holds is in your browser, on your computer.

What it holds:

• The steps of each recording - the page addresses, the way to find each element, the labels read off the page, the values you entered, watched page variables, your Callout notes, checks and their short HTML pieces, the transcribed text of your narration, and the browser and system line described above.
• The screenshots, one per step.
• The narration audio, kept only until the transcription of it succeeds, or until you delete the recording.
• Four preferences: whether narration is on, replay playback speed, and the two export defaults - whether exports show narration, and whether they include your browser and OS info.
• Anything you staged for Jira. When you choose Copy for Jira, Itra holds those steps and their screenshots until you paste them into a Jira issue or discard them. Nothing is sent at that moment.
• Your console account, once you pair one. The connection token the console issued, and the name, email address and account ID it returned with it, plus the address of the console that issued them. Signing out removes all of it from your browser.
• Where an uploaded guide went. For each capture you have uploaded, the ID of the hosted guide and the console it went to, so the Library can tell you which of your captures the console already holds. Identifiers only: no page content, and it is never sent anywhere.
• A timing record of your last five replays, and no more. It holds how long each step took and which part of it took the time, the name of each step, and the addresses of the pages the replay visited. It holds no screenshot, no narration, and nothing you typed. It is a diagnostic, for the question “why was that replay so slow?”, and it is shown to you on the replay page. It is never sent anywhere unless you copy it and paste it somewhere yourself.
• What is happening right now - which tab is recording or replaying, the latest values of watched page variables in that run, how far a replay has got, whether each step of the last replay passed, and the timing of the replay in progress. Your browser clears this when you close it.

Nothing expires or is cleaned up on a schedule, except narration audio once its transcription succeeds. A recording is kept until you delete it. Deleting a recording deletes its steps, every one of its screenshots, and its narration audio, together and immediately. Uninstalling Itra removes everything above.

Uninstalling the extension removes only what is on your computer. It does not close a console account, and it does not delete anything hosted on the console. Console data is deleted from the console, and Deleting your console data says how.

The microphone

Itra asks for your microphone only when you start a recording with narration switched on. Opening Itra does not turn the microphone on. The Test mic button does, and releases it after six seconds, or sooner if you press Stop test.

The guide narration recording is saved to your browser and transcribed there. When you stop Callout narration or press Save, its complete temporary clip is transcribed locally once and is not saved as a separate audio recording. Transcription runs a Whisper speech model inside the extension, compiled to WebAssembly. Your audio stays inside the extension and is never uploaded, in any of the paths below. During Callout, the microphone is silent while you select an element, type a note or add a check. It turns on only after you press Record narration, unless you pressed Mute, and turns off again when you stop or Save.

For guide narration, once transcription succeeds and the transcribed text has been saved, Itra deletes the raw audio from your browser. Only the transcribed text is kept, and only that text ever leaves in an export or an upload. If transcription fails, the audio is kept so that you can try again. It is also deleted when you delete the recording.

The requests the extension makes

Itra makes no network request unless you ask it to. The Whisper speech model and the WebAssembly runtime that uses it both ship inside the extension, so transcription is fully offline from the first use.

There are three things you can ask for, and no others.

Your Jira comment or description, when you ask for one. Choosing Copy for Jira sends nothing. Only when you then open a Jira issue and press Paste as a comment or Add to the description does Itra upload the steps and the screenshots you staged, to that Jira site and nowhere else. It goes as an attachment upload, and then as either a new comment or an addition to the issue’s description; the description path reads the issue’s current description first, from the same site, so your existing text is kept underneath. It travels over the Jira session you are already signed in to. The access to websites that Itra asks for at install already covers your Jira site, so there is no extra permission step, and Itra stores no Jira token, no site address and no credential of any kind. The screenshots are the ones the recording captured - see below for what they hold.

Uploading a guide to your console, described under What leaves your device. This is the only thing Itra sends to Itra, and it happens on your press.

Your own list of hosted guides. While the extension is paired, opening the Library asks your console which guides your account already hosts, so a row can tell you whether the console holds that capture. That request carries the connection token and asks a question; it sends nothing from your recordings. Signing out tells the console to revoke the connection token before Itra forgets it locally, and says so if the console could not be reached.

Itra contacts no other host. Replaying a recording does make your browser load the sites in that recording, exactly as it would if you opened them yourself.

What redaction attempts, and what it does not

Itra applies four protections to sensitive content while a recording is being made. They are bounded or pattern-based, so treat them as a safety net that will miss things, not as a guarantee.

• Password fields. When you type into a field the page declares as a password field, Itra replaces the value with •••••••• in the page, so the typed password is not carried into the step. When the recording is finalised, that step - and the plain text, email or telephone field immediately before it, in the same document - are turned into User Input steps: they carry no value at all, and replay pauses for each person to enter their own credentials. The editor tells you which steps these are, and lets you change them back to a typed value on purpose if you want one baked in. The limit. This works off the field’s declared kind. A password typed into a field the site does not declare as one is recorded like any other value. The username conversion is deliberately conservative: it only takes the field immediately before the password, and only a plain text, email or telephone field in the same document, so a username entered on an earlier screen, in a field of another kind, or in a different embedded document, is kept as a recorded value.
• Email addresses. Text shaped like an email address is masked to its first character, so ada@example.com becomes a•••@•••. This applies to values you enter, to labels Itra reads off the page, and to the short HTML piece stored for a Callout. The limit. It matches text shaped like an address. An address written another way - spaced out, with “at” for the @, or split across separate pieces of the page - is not matched. It applies only to text Itra stores, never to a screenshot.
• Credential fields in a screenshot. When the step you are taking is on a password field, or on the field immediately before one, that field’s pixels are thrown away before the image is saved: the region is rebuilt from a handful of samples, so the text in it is gone from the file rather than blurred over. It is destroyed before the screenshot is stored, so no viewer, download or share page can recover it. The limit. It reaches one field: the one that step is about. A password or username field that merely happens to be on screen during some other step is photographed in full, and so is everything else in the picture. It rests on the same declared-password rule as above, so a site that does not declare its password field gets no destruction either. If Itra cannot work out exactly where a field inside an embedded frame sits on the page, it refuses to save that screenshot rather than save one with the wrong region destroyed.
• Watched page variables. Each watched snapshot is capped, and text shaped like an email address is masked before Itra stores the change. The limit. The email mask is one pattern. It misses addresses written another way or split across values, and it does not inspect what the data means. It does not touch screenshots or narration.

Itra also strips every input value out of the short HTML piece stored for a Callout, including values on hidden inputs, and caps that piece at 1,600 characters. That removes values carried on the markup’s input elements; a value the site has written into the page as ordinary text is not an input value and stays.

These protections run while a recording is being made. A recording made before a protection existed keeps whatever was stored at the time, and adding a protection later does not reach back into it.

Other content is not redacted.

That means a recording can contain a name, a postal address, a phone number, a card number, an account number, an API key or a session token, if you entered it into an ordinary field. Page addresses are recorded whole, including the query string, which on some sites carries an access token. Apart from the one credential field described above, screenshots are not redacted: whatever else was visible in the tab at the moment of a step is in the image. The narration audio is not redacted, and neither is the text transcribed from it.

Review a recording before you share it. That is the only protection that holds for everything, and it is why the export screen previews the document before you download it.

Three things help you keep something out of a recording in the first place. Pause the recording before you do the thing, and Itra captures no page action and no screenshot until you resume. Edit a step’s text or its recorded value in the editor - which changes the words Itra stores, and not the screenshot beside them. Delete the step, which deletes its screenshot with it.

Do all of it before you export or upload, because both are copies.

Why Itra asks to read every site

Itra asks for access to all sites, and it needs it.

A recorder cannot know in advance which site you will want to record, and a recording that starts on one site and finishes on another has to follow you across. Access to all sites is what lets Itra watch the page while you record it, take the screenshot, and drive the page again when you replay. The screenshot is also why the access has to be this broad: the browser’s screenshot function is only available to an extension that holds it.

A page can embed another site inside it, and a step you take there belongs to the recording as much as any other, so Itra’s code loads inside those embedded documents too - including advertising frames, which it has no way to tell apart in advance. Only the top of the page draws Itra’s own on-screen box or reports the window size; an embedded document watches for your actions and does nothing else. Some embedded documents cannot be reached at all - a sandboxed frame, a PDF, another extension’s page - and Itra tells you in the corner box, before you interact with one, rather than silently missing the step.

Itra uses that access on the tab you are recording or replaying, and to read the address of your current tab for the badge count. It uses it nowhere else. On every other page its code is loaded and idle: each of its event handlers checks whether this tab is the one being recorded, and stops there when it is not.

What leaves your device

Nothing leaves your device until you ask for it.

There are three ways to ask, and no others.

Exporting writes a file to your computer, the way any download does. Itra does not upload the export. If you then send that file to someone, you are the one who sent it, and Itra is not involved.

Pasting into Jira does upload, to your own Jira site and nowhere else, and only when you press Paste as a comment or Add to the description yourself. It is described under The requests the extension makes above. Choosing Copy for Jira on its own sends nothing.

Uploading a guide to your console sends it to Itra, and it is the only thing that does. It happens when you press Upload to console on a capture in the Library, and it needs the extension to be paired with a console account first. It sends the guide’s steps - the same contents as an .itra file below - and its screenshots, which no other format carries off your computer by default. It does not send the narration audio, the browser and OS line, or the Callout page snippets. What happens to it once it is there is The Itra console below.

The formats do not contain the same things.

Format	What is in it
.itra bundle	The steps and watched-variable paths: page addresses, the way to find each element, the values you entered, the written instructions, and the transcribed text of your narration. No captured watched page variables, no screenshots, no audio, no Callout page snippets and no browser/OS info.
.html web page	The written instructions, which include the values you entered, the transcribed narration, and the screenshots. Watched page variables only when you select them. No audio.
PDF	The web page above, printed by your browser. Same contents.
.docx Word file	The written instructions, the transcribed narration, and the screenshots. Watched page variables only when you select them. No audio.
AI prompt copied to your clipboard	Callout notes and checks, page addresses, element paths, the sanitized short HTML pieces, and the names of the screenshots. Watched page variables on those notes only when you select them. Text only: no screenshot file and no audio. Itra does not contact an AI.
AI feedback packet (.zip)	The AI prompt above and each Callout screenshot. Watched page variables on those notes only when you select them. No audio. Itra downloads it to your computer and does not upload it.
Upload to your console	The .itra steps above, plus every screenshot. No captured watched page variables, no audio, no Callout page snippets, no browser/OS info.

Eight switches on the export screen change what the .html, PDF and .docx exports carry, and what Copy for Jira stages: which steps go in (Browser actions, Checks on the page, Notes and Callouts), what goes on every step (Screenshots, Narration, Watched page variables), and what is said about the recording as a whole (Browser window size, Browser and OS info).

Browser and OS info starts off, and adds one line - browser and version, operating system and version, and window size. Watched page variables starts off in every preset. It carries the watched page variables stored on each step only when you select it, and the preview shows those values before you export. The export screen also offers three presets, and choosing one sets all eight switches at once: the Bug report preset turns Browser and OS info on, because a bug report is meant to be reproducible. You can then change any switch yourself, and the screen names every position that differs from the preset. The starting positions for Narration and Browser and OS info come from the extension’s options.

The .itra bundle and the console upload have no switches. Neither ever carries captured watched page variables or the browser and OS line, and the .itra bundle never carries a screenshot.

The narration audio never leaves your browser in any format. The .itra bundle leaves the screenshots out on purpose, because they are the part most likely to hold something you did not mean to send. Whoever imports it captures their own screenshots on their first replay.

A recording someone sent you

Replaying a recording opens a real tab in your browser, with your logins. Its clicks and its navigations act with your authority.

So a recording you did not make is, in effect, a request to run something in your browser. Itra will not do it silently. Before the first replay of an imported recording it shows you every site that recording will open, every watched-variable path it will read, and the full source of any JavaScript or console checks in it. Watched variables are not read before you trust the recording. Itra does not run those code checks: it reports each one as unsupported and skips it without failing the replay.

That protects your browser session. Nothing about the recording, and nothing about your decision, is reported anywhere.

The Itra console

This part describes the console at console.itra.app and the public guide pages at share.itra.app. None of it happens unless you register for an account.

Your account and sign-in

Registration collects your name, email address and password. The console sends all three to the external identity provider at rc.sysinit.sh, which creates and holds your sign-in record and password credential. The same provider receives your email address and password when you sign in. It receives your email address when you ask for another verification email or a password reset email. When you complete a password reset, the provider receives the one-time information from the reset link and your new password. It returns your user ID, name, email address and session credentials to the console.

Itra’s own PostgreSQL database does not store your password. When you pair an extension, it stores your user ID, name and email address with a hash of the extension connection token; the usable token is handed to the extension and is not stored in the database. Hosted guides also carry the account’s user ID and name so Itra can show their owner.

The console uses essential session cookies to keep you signed in. Those cookies are scoped to console.itra.app, so your browser does not send them to share.itra.app at all.

What that identity provider does with your name, email address and password once it has them - how it stores them, how long it keeps them, where it hosts them, and who else it uses - is its own arrangement, and this policy does not describe it.

Guides you upload

The console holds a guide only when a paired Itra extension uploads one, and only when you ask that extension to. There is no way to upload from the console’s own pages.

An upload sends the guide’s .itra bundle and its screenshots to Itra’s server. The bundle is stored in PostgreSQL. It can contain the guide title, starting page, steps, page addresses, element details, recorded values, written instructions and the transcribed text of your narration. Screenshot records are stored in PostgreSQL and the image bytes are stored in object storage, using Cloudflare R2 in production. Raw microphone audio is not uploaded.

A hosted guide stays on the server until you delete it or delete your console account data. Re-uploading the same capture updates the hosted guide at its existing address and replaces its screenshots.

A hosted guide is a separate copy. Deleting the capture in the extension does not delete the guide the console holds, and deleting the hosted guide does not delete the capture in your browser.

Public share links

Every hosted guide has one permanent public address at share.itra.app/s/<id>. The address is not a credential and does not open the guide while its access is set to Only you. With Anyone with the link selected, anyone who has the address can open the guide without signing in.

Only you stops this link from opening the guide within 60 seconds, but it cannot recall downloaded copies, and turning link access on again reactivates the same address. Itra does not offer a way to rotate that address.

A shared guide exposes its title, its steps, the page addresses, the values you entered, the written instructions, every screenshot and every word you spoke as transcribed text. The screenshots and the transcript are there exactly as recorded. The console does not blur, mask or edit either: it hosts the guide as the extension made it, with whatever the extension’s own protections missed still in it.

Server logs

The console and share hosts sit behind Cloudflare and a Caddy reverse proxy. Requests are logged with the client IP address and ordinary request details used to operate and protect the service. The client IP address is logged for every request to both hosts.

For share.itra.app, the reverse-proxy configuration Itra supplies drops the address of the page from that proxy’s access-log entry, so a guide’s link is kept out of it. That covers the log that configuration governs. It is one setting on one shared server, and Itra cannot rule out separate logging by the infrastructure in front of it.

Deleting your console data

You can delete an individual hosted guide from its guide page. Itra removes the guide record and its screenshot records and image bytes. Setting a guide to Only you is not deletion.

In Settings, choose Delete account to permanently erase your name, email address and password, and to remove every hosted guide owned by your account, its screenshot records and image bytes in object storage, and every paired-extension token for your account. The control ends your current console session. It cannot remove a copy that another person already downloaded.

You can register again with the same email address, but that creates a separate account. Email privacy@itra.app to ask about data the Settings control does not cover.

The Itra website

This part describes itra.app - the site you are reading, and the feedback form on it.

The site collects nothing about you until you send the feedback form. It carries no analytics, no advertising and no tracking cookies.

The feedback form

There is a feedback form in the corner of every page, and a full page of it at itra.app/feedback. Nothing is sent until you press Send.

It sends your message, your email address if you chose to give one, and the address of the page you were on - which is shown to you above the Send button. That goes to the Itra inbox as one email, through Resend, the service that delivers it. If you left an email address, a reply goes back to it.

Your message is not stored on the website’s server, not added to any mailing list, and not used to advertise to you. Email privacy@itra.app to ask for one to be removed.

Server logs

The website sits behind Cloudflare. Requests to it, including a form submission, are logged with the client IP address and ordinary request details used to operate and protect the service. Itra’s own code writes no part of your message to those logs.

Children

Itra is not directed at children and does not knowingly hold data about them.

Changes to this policy

If this policy changes, the date at the top changes with it. A change to what the extension stores or sends will be described in the extension’s listing before the version that makes it is published.

Contact

Questions about this policy, or about what Itra stores: privacy@itra.app.