Privacy Policy
Last updated: August 5, 2026 · Applies to: ShotFlow — Full Page Screenshot Capturer & Mockup Studio (Chrome Extension)
Overview
ShotFlow ("the Extension") is a Chrome browser extension for capturing full-page screenshots, annotating them, and presenting them in device mockups. This privacy policy explains what data the Extension accesses, how it is used, and how it is stored.
Summary: by default, ShotFlow does not transmit any data anywhere — every screenshot, edit, and setting stays on your device. The one exception is the optional Share feature, which — only when you press it — uploads the image you are looking at to our server so you can get a link. That feature is described in full below; nothing is uploaded automatically or in the background.
Data We Do NOT Collect
Outside of the optional Share feature described below, ShotFlow does not collect, store, or transmit any of the following:
- Personal information (name, email, account details)
- Browsing history, or a log of which sites you visit
- Page text, form data, passwords, or anything you type into a website
- Cookies or authentication tokens belonging to sites you visit
- Device information, IP address, or geolocation data
- Analytics, telemetry, or usage statistics of any kind
The Extension's content script runs on pages you choose to capture so it can measure page size and prepare the page for screenshotting — it does not read, log, or transmit the page's text, DOM, cookies, or form values.
Data Stored Locally (On Your Device)
ShotFlow uses Chrome Storage (local) and an in-browser IndexedDB database to persist your captures and settings between sessions. This storage exists entirely within your browser, on your device, and is never synced to your Google or Chrome account.
- Screenshot library — thumbnails of every capture, and, if you leave the "keep full-size copies" setting on (the default), the full-resolution image too, up to a storage budget you control
- Editor and capture settings — your preferences such as image format, export quality, filename template, annotation colours, theme, and the local storage budget
- Share history — if you have ever used Share, a short local list of your own links (used to show "recent shares" and to let you revoke a link) and a randomly generated installation identifier (see below)
This data is accessible only to the Extension itself. Uninstalling ShotFlow, or clearing the Extension's browsing data from Chrome, permanently deletes all of it.
Optional Feature: Sharing a Screenshot
ShotFlow can upload a screenshot to our server to generate a link you can send to someone else. This is off by default and never automatic — it only happens when you press the Share button.
When you do, the following is sent over HTTPS to a server we operate:
- The flattened screenshot image you are sharing, including any annotations you added
- A randomly generated installation identifier stored in your browser — not your name, email, or Google account, and not linked to your identity. Its only purpose is to enforce a daily sharing limit (currently 10 uploads per day per installation)
- An authentication token that is built into the Extension, used so our server can tell the request came from ShotFlow
What happens to it:
- The image is stored at a unique, hard-to-guess link (a random 128-bit id) and is not listed, indexed, or discoverable by us or anyone else — but it is not password-protected either. Anyone who has the exact link can view it, so avoid sharing screenshots containing sensitive information
- It is automatically deleted after 30 days
- You can delete it immediately at any time by clicking Revoke, in the share dialog or from your Library
- The installation identifier is used only to count that day's uploads and is never used to build a profile or to link separate shares to one another
The server behind this feature runs on Cloudflare (Cloudflare Workers and R2 storage), which acts as our infrastructure processor for this optional feature. Cloudflare processes standard web request metadata (such as your IP address) transiently to deliver the request and to apply short-lived abuse-prevention limits on our behalf; we do not use it for tracking, and it is not shared with anyone else. See Cloudflare's privacy policy for how they handle it.
Permissions and Why They Are Required
ShotFlow requests the following Chrome permissions:
| Permission | Why It Is Needed |
|---|---|
activeTab | To capture the tab you are currently viewing when you click the extension. Grants access only to that one tab, only after you interact with the extension — not persistent access to every tab. |
scripting | To inject the capture engine into the page you choose to screenshot, so it can measure the page, scroll it into position, and stitch the tiles together into one image. |
downloads | To save the exported image or PDF to your chosen download location when you click Download. Does not read your existing downloads. |
storage | To save your capture and editor settings locally in the browser, so they persist between sessions. |
unlimitedStorage | So the local screenshot library (IndexedDB) is not capped at the browser's default storage quota — full-page screenshots can be large. |
content_scripts: <all_urls> | The capture engine needs to be able to run on whichever page you choose to screenshot, so it is present on all pages. It only activates when you start a capture, and it does not read, log, or transmit page content. |
optional_host_permissions | Requested at runtime — never at install — the first time you use Share, and scoped only to our own share server. Never requested for, or granted to, any other site. |
Third-Party Services
Aside from Cloudflare, which powers the optional Share feature described above, ShotFlow does not integrate with, communicate with, or send data to any third-party service, analytics platform, or advertising network. There is no tracking and no telemetry.
Data Retention & Deletion
Local data (your library, settings, and share history) is kept until you delete it yourself — from the Library page, from Settings, or by uninstalling the Extension, which erases everything ShotFlow stored in your browser. Shared images are kept on our server for 30 days and can be deleted sooner at any time using Revoke.
Children's Privacy
ShotFlow does not target or knowingly collect any information from users under the age of 13.
Changes to This Policy
If this policy changes, the updated version will be posted at https://multi-toolkit.com/shotflow/privacy-policy and the "Last updated" date at the top will be revised.
Contact
If you have questions about this privacy policy or the Extension, please contact:
Muhammad Sohail Nazar
Email: sohail.nazar@outlook.com
Website: https://multi-toolkit.com