Privacy

What the widget captures when someone leaves feedback, what this website measures, and who else touches that data.
Last updated 8 November 2026

When someone leaves feedback through the widget

The widget runs on sites that our customers choose to install it on. When a visitor sends feedback, the report includes:

  • the comment they wrote, and their email address only if they choose to give it;
  • a screenshot of the element or region they picked, plus that element's CSS selector, React component name and source file;
  • recent console messages and network requests from the page;
  • the page address without its query string or fragment, the page title, the referring page, screen and window size, browser user agent, language and time zone;
  • a short replay of roughly the last two minutes on the page, unless the site owner turns replay off.

Password fields, anything inside a contenteditable editor and any element the site marks with data-sensitive are never captured, and text typed into other inputs is masked in screenshots. Strings that look like secrets, such as tokens and API keys, are scrubbed from console logs before they leave the browser.

The widget can also send the sequence of pages a visitor moves through on that site, with an anonymous visitor id, their browser, and the country their connection comes from. We don't store the IP address for this.

That data belongs to the site owner's project. It stays there until they delete it, and deleting a project deletes its feedback with it. If you left feedback on someone else's site and want it removed, ask that site's owner, or write to us and we'll pass it on.

Where it is processed

The service runs on Railway with a Postgres database, and screenshots and replays are stored in Vercel Blob. Feedback text is sent to Anthropic's Claude to score sentiment, intent and urgency, and on Pro, Autopilot uses Claude to read approved feedback alongside the project's code and open a pull request. When a project owner connects GitHub, Slack, Linear, Jira or Telegram, feedback is sent there too. Emails such as “your feedback shipped” go out through Resend and carry an unsubscribe link. Payments for Pro are handled by Polar, so card details never reach us.

If you have a dashboard account

We keep your email and name, and either a hashed password or your GitHub id and avatar if you sign in with GitHub. A sign-in cookie keeps you logged in to the dashboard.

On this website

feedback-devtools.com uses Google Analytics, PostHog and Growth Radar to see which pages people read and where they came from. Growth Radar also records a sample of visits as replays with form inputs masked. These tools set cookies or keep an anonymous id in your browser. The feedback widget itself runs on this site too, so anything you send with it is handled as described above.

Getting your data deleted

We don't sell any of this data. To see, export or delete what we hold about you, email ohadf2015@gmail.com. More ways to reach us are on the contact page.