Privacy policy — Journeys Session Capture

Chrome extension. Last updated 25 August 2026.

This extension sends the browser session of one site you name to Journeys, at the service address encoded in your one-time setup code. Nothing is sent anywhere else. The extension has no server of its own, no analytics, and no third-party services.

What it reads

• Cookies and localStorage for one site, on the capture you asked for. You type the site; the browser then shows you its own permission prompt for that site's registrable domain and subdomains, and nothing is read until you accept it. localStorage is read from a tab you already have open and are already signed in to — the extension never opens a tab of its own.
• The email address of the signed-in Chrome profile. This is displayed in the popup so you can confirm which account you are about to capture, and you must confirm it every time. It is never transmitted anywhere.
• No passwords. The extension never sees or asks for one. It reads the session a tab already holds.

Where it goes

The cookies and localStorage are posted, once, to the Journeys service address in your setup code, normally app.journeys.run. The post carries a one-time setup code, valid for 15 minutes and for exactly one saved session. There is no other destination and no intermediary.

On that instance the session is encrypted at rest (AES-256-GCM) and used for one purpose: to start automated test runs already signed in to the site you captured. You can delete it at any time from the project's Sessions tab, which deletes the stored data.

What the extension stores in your browser

• The Journeys service address from your setup code, and a flag marking this Chrome profile as a test/disposable one — both in chrome.storage.local, which does not sync to other devices.
• While a capture is in progress: the one-time setup code, the instance address and the site you named, in chrome.storage.session. Chrome closes an extension popup whenever it loses focus, including when it shows you its own permission prompt, so this is what lets you reopen the popup and carry on instead of starting over. That storage is held in memory only — never written to disk, discarded when the browser closes — and the entry is dropped on success, on failure, and after 15 minutes, when the setup code expires anyway.
• Not the captured session. It is assembled in memory, posted, and dropped. It is never written to chrome.storage, IndexedDB, or any other browser storage, and a failed post is never queued or retried — a failure means starting again with a fresh setup code.

Permissions, and why each exists

• cookies — reading the session cookies of the one site you named.
• scripting — reading window.localStorage from the open tab for that same site.
• storage — remembering the instance address and the test-profile flag above.
• identity.email — showing you which Chrome account you are about to capture, in the popup only.
• <all_urls> as an optional host permission — the extension cannot know in advance which site you will name, and Chrome's API requires this declared ceiling before it can ask you for one arbitrary site at run time. It is never granted as a whole and never prompts on its own. The only host prompt you ever see names the single site you typed.

Sale and transfer of data

None. The developer of this extension receives no data from it. Nothing is sold, transferred to third parties, or used for advertising, credit scoring, or any purpose unrelated to the single feature it performs.

Children

This is a developer tool and is not directed at children.

Changes and contact

Material changes to this policy will be published on this page with a new date. Questions, or a report of behaviour that contradicts anything above, can be sent to hello@journeys.run.