Privacy policy

The extension only does something when you ask it to. It is active in two places:

• The tab you are recording, from the moment you press Start recording until you press Stop. It captures nothing from other tabs and nothing when you are not recording.
• demorail.com, so the site can tell the extension is installed and link it to your account.

For each click while recording, it captures:

• a screenshot of the visible part of the tab;
• a copy of the page's HTML and styles as it looks at that moment, including what is typed into form fields (password fields are replaced with dots);
• the page's address and title, the position of the element you clicked and its label, and the visible text on screen.

Steps are kept in the extension's local storage until they upload to your Demorail workspace, then removed. The extension also stores a sign-in token for your workspace so it can upload. It doesn't read your browsing history, cookies or passwords, and it doesn't run remote code.

Recording captures whatever is on screen, so record with test data where you can. Blur in the editor hides an area in the player, but the original capture is kept with the demo until you delete it.

When you sign up we store your name, email, company name and a hashed password (or, if you sign in with a Railhq account, the account's email and name). We use a session cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

When someone opens a published demo we record a view: a one-way hash of their IP address (not the address itself), their browser's user agent, the referring page, how far they got and how long they spent. If you turn on the email step, we store the email, name and company the viewer enters. Questions viewers ask in the demo are stored with the view. You can see this in your workspace's analytics and leads, and send it to your own tools with webhooks.

For these viewers you are the controller of that data and Demorail processes it for you. If a viewer asks us to remove their data, we will pass the request to you or delete it.

• DigitalOcean hosts our servers, database and stored captures in the United States.
• DeepSeek runs the AI features. When you use Write with AI or the capture agent, or a viewer asks a question, the step titles, text and page text needed for that request are sent to it. Screenshots are not sent.
• Stripe handles payments. Card details go straight to Stripe; we only keep your plan, subscription status and Stripe customer ID.
• Google Workspace receives email you send to hello@demorail.com.

We share data with others only if the law requires it.

Demos, captures, views and leads stay until you delete them. Deleting a demo removes its screenshots and page copies. When you ask us to delete your account, we delete its workspace, demos, captures, views and leads within 30 days, except billing records we must keep by law.

You can view, edit and delete your demos at any time in the app. To get a copy of your data, correct it or delete your account, email hello@demorail.com from the address you signed up with. You can remove the extension at any time from chrome://extensions, which deletes everything it stored in your browser.

The use of information received from the extension follows the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to build and show your demos, never for advertising, credit decisions or to sell to others, and people read it only with your permission, for security, or when the law requires it.

Questions about this policy: hello@demorail.com. If we change it in a way that matters, we'll update the date above. See also Support.