Privacy Policy
What Paintless handles, where it goes, and what is never collected.
Last updated: 2026-09-03
Paintless is open-source software you run yourself — a CLI, a widget, a browser extension and an optional self-hosted server. The project operates no servers and receives no data from you. There is no Paintless account, no analytics, no telemetry, and no third party in the path.
This page covers the browser extension and the client shells (widget and framework bindings), which are the parts that run in someone's browser.
What is handled
When you pick an element and submit a change request, the request contains:
- the description you typed;
- the element's source location (
file:line) when the site was built with a Paintless mapper, its component trail, CSS selector, outer HTML and computed styles; - the page URL, title and viewport size;
- a screenshot, when the shell you use can take one. The extension does, via
captureVisibleTab, which captures the whole visible tab — everything on screen at that moment, not only the element you picked; - a reporter name or role, only if the host application supplies one.
Where it goes
To exactly one place: the host you configure.
- In dev mode, that is
paintless devon your own machine, over a WebSocket tolocalhost. The dev host only accepts loopback origins unless you add more yourself. - In prod mode, that is the Paintless server your team self-hosts, at the URL you (or the extension's options page) configured.
From there, delivery follows your own configuration — a pull request, an issue, a ticket, a chat message or a webhook, in systems you own. Nothing is sent before you press Send.
What is stored
- Browser extension: your domain → server mappings — including the project
key for each, when you set one — in
chrome.storage.sync, so they follow your browser profile across the devices signed into it. Nothing else; the extension keeps no history of requests. Leave the project key blank if syncing it is not acceptable, and put the check in front of the server instead. - Widget and bindings: nothing is persisted.
- Self-hosted server: requests, their status and delivery receipts, in the store you configured (SQLite or JSON) on your own infrastructure. Retention is yours to decide.
Extension permissions
| Permission | Use |
|---|---|
activeTab | Run the picker and capture the screenshot on the tab whose icon you clicked, and only then. |
scripting | Inject the picker overlay into that tab on click. No automatic content scripts. |
storage | Keep your domain → server mappings. |
No host permissions are requested, so the extension has no standing access to any site.
Children
Paintless is a developer tool and is not directed at children.
Changes
Material changes to this policy are recorded in the repository's history and reflected in the date above.
Contact
Questions or a privacy concern: open an issue at github.com/kyechan99/paintless/issues.