Privacy Policy

Effective date: 22 October 2026

This policy explains what personal data is involved when you use the Bobbin Chrome extension, buy Bobbin Pro, visit getbobbin.app or contact us, and what rights you have. Bobbin is designed so that we never receive your recordings or your browsing activity.

1. Who we are

Bobbin is operated by Paras Vyas, an individual sole trader based in Pune, Maharashtra, India ("we", "us", "our"). For the data described in this policy we are the "controller" under the EU and UK GDPR, the "business" under California law, and the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Contact: support@getbobbin.app. Our Grievance Officer is named in section 16.

Our processing is limited and occasional, so we have not appointed a representative in the EU or UK. You can contact us directly about any privacy matter.

2. The short version

• Your recordings, and your camera, microphone and screen, stay on your computer. They are never uploaded to us or to anyone else.
• The extension has no account, no analytics, no ads, no trackers and no third-party scripts.
• The only network request the extension makes is to Dodo Payments' license API, and only if you enter a Pro license key.
• If you buy Pro, Dodo Payments (our merchant of record) handles the payment. We receive your order details, never your full card details.
• We do not sell or share your personal data, and we do not use it for advertising.

3. Data that stays on your device

The following is stored only in your browser on your computer. We cannot see, access or recover it.

• Recordings. While you record, video is saved in one-second pieces to the extension's local browser database (IndexedDB) so a crash does not lose it. Finished recordings stay there until you delete them, and in your Downloads folder if you download them.
• Screen, window or tab, camera and microphone. Bobbin uses these only after you allow them in Chrome's own prompts, and only while you are recording or previewing. Chrome shows a sharing indicator while your screen is being captured.
• Settings such as your chosen microphone, camera, countdown, quality and file-name options.
• An install ID: a random 12-character code created when you install Bobbin. It does not identify you and is used only in the device label described in section 4.
• License status (if you enter a Pro key): the key, its activation ID, the product name, the email address that the license server returns for the key, and when it was last checked. The email is shown on the Settings page so you can see which purchase is active.

You can delete recordings with Delete in the Bobbin Library. Removing the extension, or clearing its site data in Chrome, deletes everything above from your computer.

4. What the extension sends over the internet

Only one thing. If you enter a Pro license key, Bobbin sends a request to Dodo Payments' license API (dodopayments.com) to:

• activate the key on this device, when you press Activate. This sends the key and a device label such as "Chrome · Windows · a1b2c3d4e5f6" (browser, operating system and the random install ID);
• re-check the key, about once a day while Chrome is running and whenever you press the check button in Settings, so a cancelled or refunded key stops working. This sends the key and its activation ID; and
• deactivate the key, when you press "Remove from this device". This sends the key and its activation ID.

Like any internet request, these requests also reveal your IP address and basic technical details (for example your browser version) to Dodo Payments. If you never enter a key, the extension makes no network requests at all. Until Pro launches, key entry is switched off, so today the extension makes no network requests. The extension does not load remote code.

The extension can also open web pages for you in a new tab, such as our checkout links when Pro checkout opens. Anything you do on those pages is covered by the policy of the site concerned.

5. Chrome permissions, one by one

Bobbin asks for only three permissions in its manifest: storage, unlimitedStorage and alarms. It requests no host permissions, no access to websites or tabs, and has no content scripts, so it cannot read your browsing history or the content of the pages you visit.

• storage: saves your settings, the install ID and license status in Chrome's local extension storage on your computer.
• unlimitedStorage: screen recordings can be hundreds of megabytes or several gigabytes, more than Chrome's default storage quota. This lets Bobbin keep recordings in local storage. Nothing is uploaded.
• alarms: schedules the background check of a Pro license key (it runs hourly and contacts the license server at most about once a day). It does nothing if no key was entered.

Planned Pro drawing tool. Drawing on the page while you record is a planned Pro feature and is not in the current version. It would need an extra permission to add a drawing layer to the tab you choose. Before any new permission is added to Bobbin, we will update this policy to explain it, and Chrome will tell you about the new permission when the update arrives.

Screen sharing, camera and microphone are not manifest permissions: Chrome asks you each time (or the first time, for camera and microphone) and you can withdraw camera and microphone access at any time in Chrome's site settings. Bobbin also offers keyboard shortcuts (Alt+Shift+S to stop, Alt+Shift+P to pause), which only work while Chrome is focused and do not record your keystrokes.

6. Purchases

Pro is sold through Dodo Payments, which acts as merchant of record (the legal seller). Pro checkout is not open yet. When it is, Dodo Payments will collect your name, email address, billing details and payment information on its own checkout page to take payment, calculate tax, issue invoices, prevent fraud and send your license key. Dodo Payments handles that data as an independent controller under its own Privacy Policy.

Through Dodo Payments' dashboard we can see order and license details: your name, email address, country, the product, price, tax, date, payment and refund status, your license key and its activations (device labels). We never see or store your full card number or card security code.

After checkout, Dodo Payments sends you back to our thank-you page with your key in the web address. The page shows the key to you in your browser and then removes it from the address bar; it does not send the key anywhere.

7. Emails to us

If you email us, we receive your email address, the content of your message and any attachments, and we use them to reply and help you. Mail to support@getbobbin.app is delivered through Cloudflare Email Routing to the mailbox we use for support. Please do not send recordings that contain private information about you or other people.

8. This website

getbobbin.app sets no cookies and uses no analytics, advertising or third-party scripts. It is hosted by Cloudflare, which processes technical data needed to deliver and protect the site, such as your IP address, the pages requested and your browser type, and may keep it in short-term logs for security and abuse prevention.

9. Why we use personal data, and our lawful bases

• Activating and checking your Pro license, and enforcing the 3-device limit: license key, activation ID, device label, IP address. Basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• Providing Pro, managing orders, refunds and cancellations, and answering support requests: order details and your emails. Basis: contract (Art. 6(1)(b)), and our legitimate interest in helping you (Art. 6(1)(f)).
• Preventing fraud, key sharing, chargeback abuse and security incidents: license and order details, technical logs. Basis: legitimate interests in protecting Bobbin, our customers and our revenue (Art. 6(1)(f)).
• Keeping tax, accounting and legal records, and responding to lawful requests: order details. Basis: legal obligation (Art. 6(1)(c)).
• Serving and protecting the website: technical data processed by Cloudflare. Basis: legitimate interests (Art. 6(1)(f)).

Under the DPDP Act, we process personal data that you voluntarily provide (for example when you buy Pro, enter a key or email us) for the purpose you provided it for, and otherwise on the basis of your consent or another lawful ground under that Act. Where we rely on consent, you can withdraw it at any time by emailing us, as easily as you gave it. Withdrawing does not affect processing that already happened, and we may then be unable to provide Pro (for example, a key cannot be checked without contacting the license server).

We do not use your data for advertising, profiling, or automated decisions that have legal or similarly significant effects on you. Keys that fail the license check simply stop unlocking Pro.

10. Who we share data with

We share personal data only with the service providers below, only as needed to run Bobbin, and never for advertising:

• Dodo Payments: merchant of record for purchases, and the license server the extension contacts. Privacy Policy · Buyer Terms.
• Cloudflare, Inc.: website hosting, security and email routing. Privacy Policy.
• Google (Chrome Web Store): distributes and updates the extension. Google processes your Chrome Web Store activity under its own Privacy Policy, and shows us only aggregate statistics such as install counts. If you write a public review, Google shows it to us and other users.
• Our email provider, which stores the support mailbox that our support address forwards to.

We may also disclose data if the law requires it, to protect rights, safety or property, or to investigate fraud or abuse. If Bobbin is sold or transferred, the data would pass to the new owner only under this policy, and we will ask for your consent where the law or the Chrome Web Store policy requires it.

We do not sell or share personal information, as those words are defined in California law (including sharing for cross-context behavioural advertising), and we have not done so in the past 12 months.

11. Chrome Web Store User Data Policy

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In practice this means: Bobbin collects and uses user data only for its single purpose (recording your screen and webcam locally, and unlocking Pro); we transfer it only to the providers above as needed for that purpose, to comply with law, or to prevent fraud and abuse; we do not let people read it except with your consent, for security, or to comply with law; and we never sell it, use it for personalised advertising, or use it to decide creditworthiness or lending.

12. International transfers

We are based in India, so personal data we receive is accessed and processed in India. Dodo Payments and Cloudflare operate globally and may process data in other countries, including the United States and India. India and the United States may not have data protection laws equivalent to those where you live. Where data from the EEA, UK or Switzerland is transferred, it is either necessary to perform the contract you ask for (for example, to sell you Pro and check your key) or the provider relies on safeguards such as the European Commission's Standard Contractual Clauses or the UK equivalent, as described in its own privacy policy. You can ask us for more information about these safeguards.

13. How long we keep data

• Recordings, settings and license status on your device: until you delete them or remove the extension. We never hold them.
• Order and license records: for as long as your license is active, then for up to 8 years to meet tax, accounting and legal requirements, after which we delete or anonymise them where we control them. Dodo Payments keeps its own records under its policy.
• Support emails: up to 2 years after our last exchange, unless needed longer for a dispute or legal claim.
• Website and email-routing technical logs: kept by Cloudflare for the short periods set out in its policies.

14. Security

Keeping recordings on your device, and collecting as little as possible, is our main safeguard. The extension and website use HTTPS, a strict Content Security Policy and no third-party code, and access to our payment and hosting dashboards is limited to us. No system is perfectly secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires it. Recordings in your browser are protected by the security of your own computer and Chrome profile, so keep them secure.

15. Your rights

You can email support@getbobbin.app to exercise any of the rights below. We may ask you to confirm you control the email address used at checkout before we act, and we will not discriminate against you for using your rights. We answer within one month (45 days for California requests); where the law allows, we may extend this for complex requests and will tell you why. Remember that we cannot access data that exists only on your device; you control that directly.

EEA, UK and Switzerland (GDPR / UK GDPR). You have the right to access your personal data, correct it, delete it, restrict or object to its use (including any use based on legitimate interests), receive it in a portable format, and withdraw consent at any time. You also have the right to complain to the data protection authority where you live or work, or where you think the problem happened. In the EU, see the list of national authorities; in the UK, the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.

California and other US states (CCPA/CPRA and similar laws). In the past 12 months the categories of personal information we have collected are: identifiers (name, email address, IP address, license key, device label); commercial information (products bought, prices, payment and refund status); and internet or network activity limited to license-check requests and website server logs. We collect them from you, from Dodo Payments and from Cloudflare, for the purposes in section 9, and disclose them only to the service providers in section 10 for those business purposes. We do not collect sensitive personal information for inferring characteristics, and we do not sell or share personal information. You have the right to know what we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we do not use it); and not to be discriminated against for exercising these rights. You can use an authorised agent, and we may ask the agent for proof of authority and ask you to verify your identity. Residents of other US states with similar laws have equivalent rights and can contact us the same way, including to appeal a decision we make about a request.

India (DPDP Act, 2023). You have the right to a summary of the personal data we process about you and how we process it, and the identities of those we share it with; to correct, complete, update and erase it; to withdraw consent; to grievance redressal (section 16); and to nominate another person to exercise your rights if you die or become incapable. If you are not satisfied with how we handle your grievance, you may complain to the Data Protection Board of India after using our grievance process.

Everywhere else. Wherever you live, you can ask us what data we hold about you and ask us to correct or delete it, and we will honour your request unless we must keep the data by law.

16. Grievance Officer

In line with the DPDP Act and the Information Technology Rules, 2021, our Grievance Officer is:

Paras Vyas, Pune, Maharashtra, India · support@getbobbin.app (please put "Grievance" in the subject line).

We acknowledge grievances within 24 hours and aim to resolve them within 15 days of receipt.

17. Children

Bobbin is not directed at children and is not meant for anyone under 13. Where local law sets a higher age for consenting to the use of personal data (for example up to 16 in some EU countries, or 18 in India), people below that age may use Bobbin only with the consent and supervision of a parent or guardian. Purchases must be made by an adult or by a parent or guardian. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

18. Changes to this policy

We may update this policy when Bobbin or the law changes. We will always update it before a new version of the extension requests any new permission or collects any new kind of data. We will post the new version on this page and change the effective date. If a change materially affects how we use personal data we already hold, we will give reasonable notice, for example on this website or by email to Pro customers, and ask for your consent where the law requires it.

19. Contact

Paras Vyas, Pune, Maharashtra, India · support@getbobbin.app. See also our Terms of Service and Refund Policy.