Privacy

We store the guides you make and who you sent them to. The Chrome extension blurs private text out of every screenshot inside your browser, before anything is uploaded — the original never reaches us, and there is no part of our API that would accept one. We do not sell data, we do not run advertising, and we do not use anything you capture to train models.

• Only while you are recording. Nothing is captured before you press Start recording, and nothing after you press Stop.
• It screenshots the visible tab when you click, and measures the element you clicked so it can name the step and draw the highlight ring.
• It reads the text in that screenshot locally to find emails, account numbers, phone numbers and amounts. The OCR engine is bundled with the extension and runs offline; no image is sent anywhere for analysis.
• It destroys those pixels — downsample, blur, repaint — and only the redacted PNG is uploaded.
• It does not upload page URLs, form values, cookies or keystrokes, and it never reads a page while you are not recording.

• Account: your name, email address and a hashed password, or the name, email and Google account id if you sign in with Google.
• Guides: step titles, descriptions and the redacted screenshots, in our object storage or — if you connect one — your own Google Drive or S3 bucket.
• Recipients: the name and email address you send a guide to, when it was opened, which step was reached, and anything typed into the “I'm stuck” box.
• Never the magic link itself. Only a SHA-256 hash of each recipient token is stored, so a copy of our database cannot be replayed into anyone's guide, and nobody — including us — can read an issued link back.
• Billing: handled by Dodo Payments as merchant of record. Card details never touch our servers.

Two separate Google clients, four scopes between them, all of which Google classifies as non-sensitive:

• Sign-in asks for openid email profile — your email address and name, used to create or match your account and nothing else.
• Storage asks for drive.file, which grants access only to files this app creates in your Drive. It cannot see anything already in your Drive.

StepProof does not request any Gmail scope. Guide emails are sent from our own sender with your workspace name in the display name and your address as reply-to.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Only the processors it takes to run the product: our own servers (Oracle Cloud, Mumbai), Resend for email delivery, Dodo Payments for checkout, and — where you have connected them — your own Google Drive or S3 bucket. Nobody else, and no advertiser.

Deleting a guide deletes its steps, its recipients, their progress and the stored screenshots. Email support@onboardhive.com to delete your whole account and we will remove it, and everything in it, within 30 days. Uninstalling the extension removes its stored pairing key from your browser; you can also revoke every paired browser at once from Settings.

AI Consulting Group, Bengaluru, India — support@onboardhive.com.