1. Who we are
Toado (“we,” “us,” “our”) is a product of JH Media Group, LLC, a Wyoming limited liability company. This policy explains how we collect, use, and protect personal data when you use toado.dev, app.toado.dev, the Toado Chrome extension, the Toado MCP server, and related services (collectively, the “Services”).
2. Personal data we collect
We collect the following categories of personal data:
- Account data: name, email, company name, hashed password, and authentication tokens.
- Bug capture data: screenshots, console logs, network HAR, JS error stack traces, DOM snapshots, page URLs, viewport size, browser version, the browser’s time zone, and any annotations you create. This is the primary content of the Service and is provided by you.
- Walkthrough recordings: video of the screen, window or tab you choose to share, the narration recorded from the microphone you select, the moments you mark during a recording, and any transcript generated from the narration.
- Usage and diagnostic data: feature usage, error logs, request timestamps, IP addresses, user agents, and audit-trail entries used to operate, secure, and improve the Service.
- Billing data: collected and processed by our payment provider (Stripe). We retain only the last 4 digits, brand, and expiration of your card via Stripe’s tokenized references; we do not store full payment instruments.
- Communications: the contents of any messages you send us (support, sales, feedback).
2A. Pin lookups on sites your workspace has added
Your workspace can add a site to a project so that pins placed on its pages show up there. On those sites only, when a page loads or its route changes, the Toado extension sends that page’s origin and path to your own Toado account to ask which pins belong to it. The query string and the fragment are never sent. The answer is cached on your device for up to fifteen minutes, so returning to a page you visited a moment ago usually asks nothing at all. On every other site the extension makes no such request. Our API does not record these addresses in its logs.
2B. Extension presence and version
While you are signed in, the extension tells your own Toado account about every fifteen minutes that it is installed and which version it is running, and sends one message when it is first installed or updated to a new version. We use this to know which versions are in use, so we can support them and retire old ones. These messages carry no page address and no capture content.
3. Browser extension uninstall feedback
When you uninstall the Toado browser extension from Chrome, your browser automatically opens a one-time feedback page at toado.dev/x/uninstall. This is the only URL Chrome allows extension authors to open at uninstall time, and we use it to ask why you’re leaving so we can improve the product.
The page is optional. You can close it without submitting. If you do submit, we receive the text you wrote and the version of the extension you had installed (so we can correlate feedback with specific releases). We do not collect identifying information, IP addresses, or cookies on that page, and we do not associate the feedback with your Toado account, even if you happen to be signed in to Toado in the same browser. Feedback is delivered to an internal email address and is not shared with third parties.
4. How we use personal data
We process personal data to:
- Provide, secure, and improve the Service;
- Authenticate you and protect against fraud and abuse;
- Communicate with you about your account, transactions, and product updates;
- Comply with legal obligations and respond to lawful requests.
We do not sell personal data, and we do not use it for advertising or third-party profiling.
AI processing. Where your workspace has AI features switched on, ticket text, walkthrough transcripts and the text of your narration may be sent to Anthropic to write a ticket’s title and description. Narration audio is transcribed by OpenAI, and only while your workspace has AI features switched on. A workspace with AI features switched off sends nothing to either provider. For a report sent through the bug report widget, a visitor’s narration may be written up the same way, but the note the visitor typed is kept word for word and is never sent to a model.
5. Legal bases (EEA / UK)
For users in the EEA or UK, we process personal data under one or more of the following legal bases under GDPR / UK GDPR: (a) performance of a contract with you; (b) our legitimate interests in operating and improving the Service; (c) compliance with our legal obligations; and (d) where required, your consent.
6. Cookies and similar technologies
The marketing site (toado.dev) does not currently use tracking cookies or third-party analytics that profile visitors. The application (app.toado.dev) uses strictly necessary cookies for authentication and session management (HttpOnly, SameSite=Lax). Lax is required so that the Chrome extension’s OAuth consent flow can return you to the app while still authenticated; Strict would break that flow. If we add analytics in the future, we will use a privacy-friendly provider (e.g., Plausible, Fathom) that does not require a cookie banner under most regimes; this page will be updated accordingly.
Do Not Track: some browsers transmit a “Do Not Track” (DNT) signal. Because there is no consistent industry standard for how DNT signals should be honored, we do not respond to DNT signals. You can still opt out of any tracking we add in the future using the controls described here, and California residents may exercise rights described in § 13.
6A. Bug report widget submissions
A Toado customer may install the bug report widget on a product it controls. A report may include a screenshot, description, page URL, viewport and browser information, console entries, JavaScript errors, and network metadata. If the customer explicitly enables deep capture, request and response details may also be included. Reporter name and email are optional and depend on the customer's widget configuration or host-product integration. We may process IP addresses to prevent abuse. The customer is responsible for notifying its users and configuring the widget appropriately for its application.
Visitor screen recordings. Where the customer has switched the feature on, a visitor can record the page from the widget, with or without their voice. The video, the narration and the moments the visitor marks while recording are uploaded to that customer’s Toado workspace.
Page details. A widget report or recording may carry console messages, network request details, JavaScript errors and performance timings from the page the visitor was on. These are redacted in the visitor’s browser before they are sent, and again on our servers, under the same rules we apply to captures made with the extension.
Transcription and AI. Where the customer’s workspace has AI features switched on and the visitor recorded with a microphone, the narration audio is sent to OpenAI for transcription on the terms set out in § 8A, and the transcript may then be sent to Anthropic to write up the ticket. A recording sent without a microphone is not transcribed. The note the visitor typed is kept word for word and is never sent to a model.
Telling people from bots. The widget uses Cloudflare Turnstile to check that a submission comes from a person. Cloudflare receives the visitor’s IP address, a challenge token and basic signals from the browser in order to return that verdict.
7. Data you redact before upload
Toado redacts sensitive HTTP headers (Authorization,
Cookie, Set-Cookie, x-api-key,
webhook signature headers, and others), URL query parameters that match
common credential names (token, access_token,
api_key, and similar), URL fragments (where OAuth
implicit-flow tokens often live), and credential-shaped JSON keys inside
request and response bodies. This redaction runs in the extension on
your local machine before any capture leaves your browser. The same
rules are re-applied on our servers as a defense-in-depth check. You
can extend the list with workspace-specific header names from the
extension’s Options page.
The annotation tools on each ticket include a black-out shape that visually covers regions of the captured screenshot. This is a visual layer on top of the original capture; the captured image itself is preserved unchanged in your workspace’s storage so that ticket history stays intact. Black-out shapes are not a substitute for redacting sensitive information before it reaches the page being captured. Annotations and the underlying ticket are editable by anyone in your workspace who has edit permission.
8. Iframe content
When you capture a page, Toado captures the same console, network, and JavaScript-error data from any iframes that page embeds (for example, an embedded payment widget, a third-party support chat, or an analytics dashboard). This applies to iframes from any origin the host page chose to embed; we capture only what the host page already loaded as part of itself.
Why this matters: many web applications render their most important interactive content inside iframes (Stripe Elements, embedded analytics, microfrontends). Capturing only the top frame would silently miss the very logs you are trying to debug.
The same client-side header redaction that protects your top-frame
requests applies to iframe requests. Sensitive headers
(Authorization, Cookie, x-api-key,
and any extra patterns you configure in the extension’s Options
page) are stripped before any data leaves your browser. Server-side
redaction runs again on receipt as a second line of defense.
8A. Audio: walkthrough recordings
Walkthrough recordings. When you start a recording, your browser asks you to choose a screen, window or tab to share. Toado records the surface you picked, together with your narration from the microphone you select. Only the surface you choose is recorded, so if you choose an entire screen, everything visible on that screen while the recording runs is included. Toado does not record your computer’s audio output, only the microphone you select. A project can be set to record narration only, in which case no screen is shared and only the audio is uploaded. The video and the narration are uploaded to your workspace and stored with the recording and with any tickets created from it. Chrome displays its own sharing indicator for as long as a recording is running, and you can stop it at any time.
Transcription of recordings. Where your workspace has AI features switched on, we generate a text transcript of a recording’s narration, so that recordings are searchable and so that tickets created from a recording carry what you said about them. Transcription is performed by OpenAI, acting as our subprocessor: we send the audio track of the recording and receive text in return. Under OpenAI’s API terms, data submitted through the API is not used to train their models. Where your workspace has AI features switched off, no audio is sent and no transcript is made. A transcript is stored with the ticket it belongs to and is kept for as long as that ticket is kept, including after the recording’s video has been deleted under § 12.
8B. Dictation in the Toado app
The description field on a ticket in the Toado web app has a microphone button that lets you speak a description instead of typing it. It uses your browser’s built-in speech recognition. In Chrome, that means your browser sends the audio to Google’s speech recognition service and hands back text. The audio does not go to Toado. We receive only the resulting text, as part of the description you save, and we do not receive, store or have any access to dictation audio. The Toado browser extension has no dictation feature.
9. How we share data
We share personal data only with:
- Subprocessors we use to operate the Service. The current list is on our Security page.
- Authorized members of your team, under your control and the role-based access we provide.
- Your browser’s speech recognition service, when you dictate a description in the Toado web app. This transfer is made by your browser rather than by us, and we do not receive the audio. See § 8B.
- Government, law enforcement, or regulators, when legally required and after appropriate review.
- Acquirers, in the event of a corporate transaction (merger, acquisition, asset sale), under contractual obligations equivalent to this policy.
10. International data transfers
Our infrastructure is currently hosted in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) and equivalent mechanisms. A Data Processing Addendum is available on request from contact@jhmediagroup.com.
11. Security
We implement administrative, technical, and physical safeguards designed to protect personal data, including TLS 1.2+ encryption in transit, encryption at rest for stored captures and database volumes, role-based access controls, rate limiting, audit logging, and least-privilege access for our team. The full posture is documented on our Security page. No system is perfectly secure; we cannot guarantee absolute security.
12. Retention
We retain bug capture data for as long as your account is active, plus 30 days after deletion to allow account recovery. Audit logs are retained for 365 days regardless of plan. Billing records are retained for 7 years to meet tax and accounting requirements. Anonymized, aggregated data may be retained indefinitely for analytics purposes.
A walkthrough recording that you do not turn into tickets is deleted seven days after it is created, and a recording you discard is deleted on the next daily cleanup pass. Once a recording has produced tickets, its video is kept for a period set by your plan, counted from the recording: seven days on the free plan and forty-five days on the paid plans. Those are the current defaults, and an administrator may set a different period for a plan. When the period runs out we delete the video and nothing else. The ticket, its description, the screenshots taken at the moments you marked, and the transcript of your narration are all kept for as long as the ticket itself is kept.
13. Your rights
Depending on your location, you may have the right to access, correct, delete, export, restrict processing of, or object to processing of your personal data, and to lodge a complaint with a supervisory authority. You can view and correct your account information from the user settings page. For deletion, export, or restriction-of-processing requests, contact contact@jhmediagroup.com and we’ll respond within 30 days.
California residents have additional rights under the CCPA / CPRA, including the right to know, delete, correct, and opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law.
Categories of personal information we collect (CCPA notice). In the last 12 months we have collected the following categories of personal information, and we disclose them to subprocessors solely for the business purposes described in § 4:
- Identifiers (e.g., name, email, account ID, IP address).
- Customer-records information (Cal. Civ. Code § 1798.80) (e.g., billing name, hashed password).
- Commercial information (e.g., subscription plan, transaction history).
- Internet or other electronic network activity (e.g., feature usage, session timestamps, error logs).
- Geolocation (city-level, derived from IP; we do not collect precise GPS).
- User-supplied content (the bug captures, annotations, and comments you submit; this content may incidentally include other categories of personal information depending on what was on the page captured).
- Audio, electronic, visual or similar information (screenshots, screen recordings made with the extension or through the bug report widget, and the narration recorded with them).
We do not collect biometric, professional, education or sensitive personal information categories. We do not use voice recordings to identify anyone, so narration is not biometric information as California law defines it. We do not sell or share any personal information. We do not use personal information for cross-context behavioral advertising.
14. Children
Toado is not directed to and is not intended for use by anyone under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, contact us and we will delete it.
15. Automated decision-making
We do not engage in solely automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Article 22.
16. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to active account holders and posted at the top of this page with an updated revision date. Your continued use of the Service after a change constitutes acceptance of the updated policy.
17. Contact
Privacy questions or requests: contact@jhmediagroup.com.
Postal: JH Media Group, LLC, Attn: Privacy, 1740 Dell Range Blvd Ste H 13-84075, Cheyenne, WY 82009, USA.