Extension

Tab capture, the Firefox difference, the no-network promise, and the redaction overlay truth.

Em dashes in quoted shipped strings are shown as plain hyphens; the originals use em dashes.

Tab capture

Snap tab captures the visible area of the current tab instantly (captureVisibleTab) without closing the popup. Restricted pages (chrome://, the Web Store, other extensions) cannot be captured; the toast says "Can't capture this page (try a normal http/https tab)" (apps/extension/popup.js:19).

Window and screen capture live on the board tab, because the picker is reliable there; the popup says so and routes you.

Keep sharing holds the tab or window you picked as a live stream, so S re-snaps it without re-picking. The browser shows its own sharing indicator the whole time, a green pulsing "sharing live" chip with a stop button shows on the board, and nothing is stored until you snap (apps/extension/app.js:54-64).

Record tab (Chromium only)

Record tab uses tabCapture plus an offscreen document and takes the tab's audio too. The shipped consent title, verbatim (apps/extension/popup.js:63, which uses a plain hyphen in the source): "Records this tab and its audio. On a call that includes everyone else, and their meeting app will NOT show a recording indicator. In many countries and US states, recording someone without telling them is a criminal offence - tell them first." This warning is load-bearing and never moves.

Once the popup closes, the toolbar icon's red REC badge is the only always-visible sign a tab is being recorded (apps/extension/background.js:109-111). Stopping clears the badge even if delivery later fails, deliberately: a badge that lies is worse.

The finished recording lands on the board: written into the granted save folder (one subfolder per page section, collision-suffixed), or, with no folder granted, downloaded to Downloads. The card's note names exactly where it went.

The Firefox difference

Firefox has no chrome.tabCapture, so the Record tab button removes itself and the audio warning never renders. This is feature detection, not browser sniffing (the supported check in apps/extension/popup.js). Recording on Firefox means the desktop app. Folder save also needs Chrome or Edge (showDirectoryPicker); elsewhere the folder button reads "n/a" and saves fall back to Downloads.

What leaves this browser, and what does not

⚠ THIS SECTION WAS HEADED "The no-network promise" AND SAID THE LISTING PROMISES "No network requests, no data collection", WITH A CSP ALLOWING "only self, blob and data sources". Both went false in 1.24.0, when sign-in shipped: auth.js POSTs a single-use code to app.snapbuddy.ai and the CSP's connect-src names that origin. Corrected rather than deleted, because the shape of what replaced it is the useful part - the extension did not gain "network access", it gained one address, for one purpose, that the browser itself enforces.

⚠ AND THEN IT WENT FALSE AGAIN IN 1.25.0, ONE RELEASE LATER, FOR THE SAME REASON. The paragraph below used to name signing in as the sole thing that ever left, and to promise that captures, notes, annotations and developer logs stayed put whether you were signed in or not. A card's Upload button shipped in 1.25.0 and POSTs one picture to /api/extension/captures (sbUploadCapture in background.js), so both sentences were false the day 1.25.0 was published. That is the fourth claim of this class to ship - docs/opus5-handoff/CURRENT.md §1 holds the first three - and the first to ship inside docs/kb, which no check read at all. The old wording is described here rather than quoted, because check-promises.mjs now reads these pages as published copy and a false sentence in a correction notice is still a false sentence on the page.

Signing in and uploading are the two things this extension sends anywhere. Nothing is uploaded unless you press Upload on a card, and every other card stays in this browser. When you do press it, that one picture goes to your SnapBuddy workspace and a link to it lands on your clipboard; your note, your tags, your annotations and your developer log do not go with it, recordings are not uploaded at all, and this extension cannot delete the copy on the server. Nothing durable is stored for the session either - an access token in chrome.storage.session and no refresh token at all, so a browser restart signs you out. scripts/check-promises.mjs keys the published claim to the manifest's connect-src where the browser enforces it - a remote origin present means the copy must not claim otherwise AND must name what leaves, and every https origin the scripts mention must be one the CSP permits - and keys the UPLOAD claim to the upload path's existence instead, because the upload proxies to the origin sign-in already used and so does not move connect-src at all. That claim is now an equality join: the sentence in bold above must appear word for word both here and in the extension's own Settings row, and any rewording of either fails the build. It still caps the description at Chrome's 132 characters, and it joins the store listing's pasted short description to manifest.description by equality - after that block spent a release saying "Nothing is sent." in words no phrase rule was watching for. Everything else lives in IndexedDB in your browser: cards in one store; preferences (auto-save, metadata, strip URLs, theme, accent, the folder handle) in a meta store. Never chrome.storage.sync, because sync round-trips through Google. The Inter font ships inside the package.

Copy text copies your raw note only; there is no environment bundle on this surface. The desktop's Copy prompt is the bigger tool.

Backup and restore

Backup is a local JSON download of every card. Restore reads a local file and sanitizes every field: status allowlist, hex colours, annotation cap 200, note cap 20k, and video file names stripped to a bare basename so a crafted backup cannot point outside the save folder (verified live). Restore MERGES into what is already there, matching by card id, and reports "Imported N" (apps/extension/core.js:318). A backup does NOT contain recordings' video files, the save-folder permission, or settings.

The redaction overlay truth

On a still, redact, blur and pixelate are baked into the PNG when you save; the hidden pixels are genuinely gone. On a recording they are data drawn over the player - the video file still contains everything they cover, and the shipped warning under the player says so.

⚠ THIS SECTION SAID THE WARNING WAS "permanent" BECAUSE "the extension has no ffmpeg and will not get one, so there is no burn-in here". The reasoning was wrong, not just the conclusion: burn-in does not need ffmpeg. The web proved it with a canvas draw loop into a MediaRecorder - the same two APIs this extension already uses for its camera bubble - and the port followed. The warning is not permanent; it now names the way out. What stays true is the part a reader depends on: until you burn them in, an overlay redacts nothing, and that is the sentence the check holds the page to, in both directions, so it can neither disappear nor be inverted into "sharing the file is safe".

Marks made with Annotate here get a three-second window at the playhead by default; each mark's row offers in, out, always and remove; timed marks survive Backup and Restore; they are never in the video file and never in the .md.

The trash

Deleting a card on the board moves it to the Trash, where it stays for 90 days. Set the board's filter to Trash to see what is in there, with a countdown on each card, Restore to put one back, and Delete forever to remove it now instead of waiting. Anything past its 90 days goes the next time you open the board or the popup.

It never deletes a file from your disk, at any point, not even when the 90 days are up. Anything already written to your save folder or to your Downloads is yours and stays where it is, so emptying the Trash removes the card and leaves the files. That is the one way this differs from the desktop app, which owns its recordings folder and removes the file with the card.

⚠ This section said the opposite until 2026-08-21 - "delete is permanent after one confirm; the extension has no trash" - and it was true until then. It is the source two shipping marketing claims were written from (band-faq.tsx, band-places.tsx), both of which went false with it. DECISIONS.md, "the extension gets a trash".

The sentence a support agent can paste

"Recording a tab records everyone on the call, and their meeting app will not warn them; in many countries and US states that is a criminal offence, so tell them first."