Notes for IT and security reviewers
One page with the facts a reviewer needs before allowing ClarShot in a team: what it is, what it can reach, where data goes, and how to check each claim yourself.
At a glance
| What it is | A browser extension (Manifest V3) for screenshots, screen recording and annotation. Runs in Chrome, Edge, Brave and other Chromium browsers, Chrome 123 or newer. |
|---|---|
| Provider | ROEM NOSIS SRL, operating as Voicu.app, Cluj-Napoca, Romania. Full identification on the Legal page. |
| Distribution | Chrome Web Store and Microsoft Edge Add-ons, updated through the store like any other extension. No separate installer, no sideloading. |
| Network activity | None. The free extension makes no requests to any server, ours or anyone else's. No update checks of its own, no license checks, no fonts or scripts fetched at runtime. |
| Accounts and sign-in | None. Nothing asks who the user is. |
| Telemetry, analytics, crash reporting | None, and no opt-in version of it either. |
| Where data is stored | Only in the browser profile on the device: the extension's own storage for preferences, and the browser's local database (IndexedDB) for captures in progress, the last 10 exported images and recordings in progress. Exported files go to the Downloads folder or the clipboard. |
| Host permissions | None. No "read and change all your data on all websites", no site-specific access. |
| Remote code | None. Everything ships inside the package; Manifest V3 forbids remotely hosted code. |
| Third-party services | None embedded in the extension. This website has no cookies, trackers or third-party scripts. |
| Price | Free. A paid Pro tier will come later for presentation polish, as a one-time purchase with an offline license key; it will not add network activity. Pricing principles. |
| Contact | support@clarshot.com, answered by a person. |
What happens when someone captures
- The user clicks the toolbar icon or presses a shortcut. The browser grants the extension access to that one tab, for that one action.
- The capture opens in the editor, which is a page inside the extension. Annotation, blur and crop happen there, on the device.
- The user exports: a file in the Downloads folder, or an image on the clipboard. The last 10 exported images stay in the popup's Recent list, on the device, until removed.
Where the file goes afterwards is the user's decision. ClarShot has no server that could receive it. If the Downloads folder is synced by OneDrive, Google Drive or Dropbox, that service, not ClarShot, may upload the file under its own policy.
Permissions, and what is not requested
These six permissions appear on the install prompt. Each one maps to a visible feature.
| Permission | Used for |
|---|---|
activeTab | Capturing the tab the user is looking at, only when they click ClarShot or press a shortcut. |
scripting | Drawing the selection overlay and scrolling the page for full-page capture, injected on demand into that tab and removed when done. |
tabCapture | Recording the current tab's video and audio, only when the user starts a tab recording. |
offscreen | Running the recording pipeline in a hidden extension page, which Manifest V3 requires. |
downloads | Saving exports to the Downloads folder when the user clicks Download. |
storage | Keeping preferences and the Recent list on the device. Never synced, never sent. |
Not requested: host permissions of any kind, access to browsing history, bookmarks, cookies or other extensions, OAuth scopes to Google, Microsoft or any third party, and no background access to tabs the user did not act on. Recording a window or the whole screen uses the browser's built-in screen-sharing chooser; the user's choice in that dialog is the consent, and it needs no extra permission.
How to verify these claims yourself
- Network. Open a capture in the editor, press F12, pick the Network tab, clear it, then annotate, download and copy. The list stays empty. The same holds for the popup and the recorder page.
- Permissions. On the store listing, the install prompt lists exactly the six above. In the browser, the extension's details page shows the same list and no site access.
- Package. With Developer mode on in the extensions page, the unpacked files can be inspected: one manifest, the pages, compiled scripts, fonts and icons. No external URLs are referenced at runtime.
- Storage. In DevTools on an extension page, Application → Storage shows the IndexedDB database and extension storage described above, and nothing else.
Allowing or blocking it for a team
ClarShot is a normal store extension, so it is governed by the same policies as any other. In Google Admin or Windows Group Policy, Chrome's ExtensionInstallAllowlist and ExtensionInstallForcelist policies take the extension ID; Microsoft Edge has the same policies under the same names. Updates arrive through the store; there is no separate update channel to allow.
| Microsoft Edge Add-ons | Extension ID feaihccglhmfpdlgppkfepchihdghmih. For a force-install entry, append the Edge store update URL: feaihccglhmfpdlgppkfepchihdghmih;https://edge.microsoft.com/extensionwebstorebase/v1/crx |
|---|---|
| Chrome Web Store | Listed here as soon as the Chrome Web Store listing is published. |
Data retention on the device
- A capture handed to the editor is consumed by it; leftovers are removed automatically within minutes.
- The Recent list holds the last 10 exported images; users can remove any or all of them from the popup.
- Pieces of an unfinished recording are removed after 24 hours.
- Uninstalling removes the extension's storage. Files already exported are not affected.
- Nothing exists on our side to retain, export or delete.
Limits worth knowing
- ClarShot adds no encryption on top of the browser's storage. Anyone who can use the device and the browser profile can open its local data, the same as for any extension.
- Browser-internal pages and the store itself cannot be captured; the browser refuses this for every extension, and ClarShot shows a message instead of a blank image.
- The source is not public yet. The checks above do not need it; publishing the core later is on the table.
Documents
Privacy promise and policy · Terms · Legal notice · Questions: support@clarshot.com