Report Feedback — Privacy Policy
Report Feedback is an internal quality-assurance tool. It lets a tester file a Jira ticket from the page where they found a bug, attaching the evidence the browser already had — what they clicked, what the app logged, what the screen looked like.
This policy describes every category of data the extension touches, where it goes, and how to remove it.
1. Where data goes
The extension sends data to exactly one destination: https://qa-bug-reporter-api.monotype-dev.com, a Monotype-operated internal service. That service — not the extension — files the report into Monotype's own Jira instance. The extension makes no request to Jira and holds no Jira credential.
There is no analytics service, no telemetry, no error-reporting service, and no third-party or author-operated server. No data is sold, rented, or shared with any third party. No data is used for advertising, credit assessment, or any purpose other than filing and managing the bug report you asked it to file.
Once the report reaches Jira it is governed by Monotype's Jira instance and Atlassian's terms, not by this extension.
2. What is stored on your device
Held on your computer, in Chrome's extension storage and — for screenshots and recordings shared between tabs — in the extension's own IndexedDB database. None of it is transmitted except as described in section 4.
| Data | Why |
|---|---|
| Your Jira email address | So tickets are filed under your name |
| Your Jira account ID and display name | Returned when your email is verified; used to set the ticket's reporter |
| Your settings | Replay buffer on/off, verbose logging on/off, the URL scope list, and any extra domains you added |
| Evidence not yet filed | Recorded actions, captured logs, screenshots and recordings for a report you have started but not submitted |
Evidence is short-lived by construction: buffers are capped (50–200 entries, 15 screen frames), the replay buffer only ever retains the last 30 seconds, and everything is discarded when a ticket is filed or when you clear it.
Screenshots and recordings you have not filed yet are written to the extension's IndexedDB database so they are not lost if Chrome shuts the extension down between you capturing them and pressing Submit. They are deleted when the ticket is filed, and Delete everything stored locally removes them outright. Replay frames are never written to disk.
3. What the extension records, and when
Everything the extension records by itself — your clicks, the page's errors, its failed requests, the page address — happens only on the sites it is installed to run on: by default Monotype's own product domains (monotype.com, monotypefonts.com, myfonts.com, extensis.com and their beta, pre-prod and development variants) and localhost, plus any domain you add yourself under "Extra domains", and only in the top-level frame, never inside embedded iframes. Everywhere else no script is injected at all, so there is nothing to record and nothing to stop.
Screen recording is the exception, and it is important that you understand it. When you press Record Video, Chrome — not this extension — asks you to choose what to film, and it offers a browser tab, an application window, or your entire screen. What you pick is what is captured, including anything visible in it that has nothing to do with the site you are testing: another application, a chat window, a personal email tab, anything else open on that screen. The extension cannot see what you chose and cannot filter it; it receives the picture Chrome gives it, and that picture is attached to the Jira ticket you file.
You choose the surface every time, Chrome shows its own sharing indicator for as long as it lasts, and you can stop at any moment from Chrome's bar, this extension's toolbar icon, or the bar it puts on the page. Pick the narrowest surface that shows the bug — usually the tab itself — and close anything you would not want attached to a ticket before you pick a whole screen.
Always recorded on a covered page
- What you interact with: clicks, form-field entries, navigations, dialogs opening and closing, and on-screen messages. Recorded as the name of the control ("Clicked 'Add to cart'") and the name of the field — never the text you type into it.
- Console errors and warnings produced by the page.
- Failed network requests only: method, address, status, and the request body. Successful requests are not recorded.
- Page address, browser user-agent, and window size, attached to the report as environment information.
Recorded only when you ask
- Screenshots — when you press the screenshot button, and only if you have allowed screen capture in settings. Until you do, the button is switched off.
- Screen recordings — when you press record, of the tab, window or whole screen you choose in Chrome's own dialog. See the warning above: whatever is visible on the surface you pick is captured, including content unrelated to the site under test. An indicator is shown throughout and you can stop at any time.
- Rolling 30-second screen buffer — off unless you switch it on. While on, the visible tab is captured every two seconds so the last 30 seconds exist when you ask for them. A blinking indicator sits on the extension's on-page button and
RECappears on its toolbar icon, on every tab it is capturing, for as long as it runs. Switching it off stops capture immediately and discards what was buffered. It captures only on the sites listed above: if a page navigates somewhere the extension does not run, capture stops there and resumes only on your return. - Verbose console output (
log,info,debug) — off unless you switch it on.
Never recorded
- Text you type into the page's own form fields, including rich-text and editable areas. Field names are recorded; what you type into them is not, and neither is the text of any element you type into.
- Cookies, passwords, authentication headers, or browser credential storage.
- Successful network requests, or any response body.
- Browsing history and bookmarks.
- Activity on pages the extension has no permission for — with the single exception of a screen recording, where you choose the surface and anything visible on it is captured. Nothing else the extension records can reach outside the sites above.
Redaction
Before anything is stored, values whose name suggests a secret — password, token, authorization, session, cookie, API key, one-time code, card number and similar — are replaced with [redacted] in request bodies, in web addresses, in URL fragments, and in objects the page logs to its console. Redaction is unconditional and is not affected by any setting.
Redaction is pattern-based and is a safety net, not a guarantee. It matches on the name of a field, so a secret stored under an unrecognised name, or embedded in free-form text, can survive it. Review the report before you submit it — every recorded log line, action and screenshot is shown to you on the form first.
Screenshots and screen recordings are not redacted. They are pictures of whatever was on screen, including anything visible in the page at the time.
4. When data leaves your browser
| Moment | What is sent | Why |
|---|---|---|
| You enter your email during setup | Your email address | To look up your Jira account so tickets carry your name |
| You open the report form and enter a project key | The project key | To read that project's fields and environment options |
| You press Submit | The report and all attached evidence | To create the Jira ticket |
Nothing is sent on a schedule, in the background, or without one of the actions above. If you close the form without submitting, nothing captured is transmitted.
5. Who can see a filed ticket
A submitted report becomes an ordinary Jira issue in the project you chose, visible to whoever that project is visible to. Screenshots, recordings and logs are attached to it. Treat submitting as publishing to your Jira project.
6. Deleting your data
In the extension: Settings → Your data → Delete everything stored locally. This removes your Jira identity, every setting, and any unfiled evidence — including the screenshots and recordings held in IndexedDB.
Removing the extension deletes everything it stored.
Tickets already filed are ordinary Jira issues and are not affected by either. To remove one, delete it in Jira or ask a Jira administrator.
7. Permissions, and why each is needed
At install, Chrome asks only for the sites the tool actually runs on — Monotype's own domains and your local development server. Those are listed in the extension's manifest, and they are what constrains it: on every other site nothing is injected, nothing is recorded and no button appears. You can add a site to that list yourself in settings; you cannot be added to it silently.
Screenshots are a separate, optional permission you are asked for once. The Chrome API that photographs a tab accepts only an all-sites permission — there is no per-site version of it, because it captures the visible area of a window rather than a single page. So the extension does not ask for it at install. It asks on the settings page, where you can read why before you decide, and you can take it back from the same checkbox at any time.
Declining it costs you the pictures and nothing else: recorded steps, console errors and failed requests still work, and a bug can still be filed. While it is off, the screenshot and replay controls are visibly switched off rather than left to fail.
| Permission | Asked at | Why |
|---|---|---|
Monotype domains and localhost | Install | The sites the tool actually runs on |
| Monotype's internal API | Install | To file the ticket. The only server the extension sends a report to |
| Storage | Install | To keep your identity and settings on your device |
| Tabs | Install | To tell which tab is in scope and to order evidence correctly |
| Scripting | Install | To run on the extra domains you add yourself in settings |
| Access to all websites | Optional, on the settings page | Required by Chrome's screenshot API. Refusing it disables screenshots and the replay buffer, nothing else |
| Other sites you add yourself | Never asked | Only sites you type into "Extra domains" in settings. Removable there at any time |
8. Children
Not directed at children and not intended for use by anyone under 16.
9. Changes
Material changes will be reflected here with a new date, and — where the change affects what is collected — in the extension's release notes.
10. Contact
operations@monotype.com