Notes for IT and security reviewers

At a glance

What it is

A browser extension (Manifest V3) for screenshots, screen recording and annotation. Runs in Edge, Chrome, Brave and other Chromium browsers, version 123 or newer.

Provider

ROEM NOSIS SRL, operating as Voicu.app, Cluj-Napoca, Romania. Full identification on the Legal page.

Distribution

Microsoft Edge Add-ons and the Chrome Web Store. Updated through the store like any other extension. No separate installer, no sideloading.

Network activity

None. The free extension makes no requests to any server, ours or anyone else's. No update checks of its own, no license checks, no fonts or scripts fetched at runtime.

Accounts and sign-in

None. Nothing asks who the user is.

Telemetry, analytics, crash reporting

None, and no opt-in version of it either.

Where data is stored

Only in the browser profile on the device: the extension's own storage for preferences, and the browser's local database (IndexedDB) for captures in progress, the last 10 exported images, recordings in progress and unsaved recordings (7 days). Exported files go to the Downloads folder or the clipboard.

Host permissions

None. No "read and change all your data on all websites", no site-specific access.

Remote code

None. Everything ships inside the package; Manifest V3 forbids remotely hosted code.

Third-party services

None embedded in the extension. This website has no cookies, trackers or third-party scripts.

Price

Free. A paid Pro tier, in development, will add your brand on every export and more private data covered before you share: a one-time purchase for up to 3 people, with an offline license key and a VAT invoice from Paddle, our reseller. It will not add network activity. Pricing principles.

Contact

support@clarshot.com, answered by a person.

What happens when someone captures

1. The user clicks the toolbar icon or presses a shortcut. The browser grants the extension access to that one tab, for that one action.
2. The capture opens in the editor, which is a page inside the extension. Annotation, blur and crop happen there, on the device. An image the user pastes, drops or picks in the editor is read only at that moment and held in that tab's memory until the tab closes; it is never written to storage or sent. An export that contains it is kept in Recent like any other export. Paste needs no clipboard permission: the browser hands the image over only on the user's own Ctrl+V.
3. The user exports: a file in the Downloads folder, or an image on the clipboard. The last 10 exported images stay in the popup's Recent list, on the device, until removed.

Where the file goes afterwards is the user's decision. ClarShot has no server that could receive it. If the Downloads folder is synced by OneDrive, Google Drive or Dropbox, that service, not ClarShot, may upload the file under its own policy.

Permissions, and what is not requested

These six permissions appear on the install prompt. Each one maps to a visible feature.

Not requested: host permissions of any kind, access to browsing history, bookmarks, cookies or other extensions, OAuth scopes to Google, Microsoft or any third party, and no background access to tabs the user did not act on. Recording a window or the whole screen uses the browser's built-in screen-sharing chooser; the user's choice in that dialog is the consent, and it needs no extra permission.

How to verify these claims yourself

1. Network. Open a capture in the editor, press F12, pick the Network tab, clear it, then annotate, download and copy. The list stays empty. The same holds for the popup and the recorder page.
2. Permissions. On the store listing, the install prompt lists exactly the six above. In the browser, the extension's details page shows the same list and no site access.
3. Package. With Developer mode on in the extensions page, the unpacked files can be inspected: one manifest, the pages, compiled scripts, fonts and icons. No external URLs are referenced at runtime.
4. Storage. In DevTools on an extension page, Application → Storage shows the IndexedDB database and extension storage described above, and nothing else.

Allowing or blocking it for a team

ClarShot is a normal store extension, so it is governed by the same policies as any other. In Google Admin or Windows Group Policy, Chrome's ExtensionInstallAllowlist and ExtensionInstallForcelist policies take the extension ID; Microsoft Edge has the same policies under the same names. Updates arrive through the store; there is no separate update channel to allow.

Data retention on the device

• A capture handed to the editor is consumed by it; leftovers are removed automatically within minutes.
• The Recent list holds the last 10 exported images; users can remove any or all of them from the popup.
• A recording that was not saved (interrupted, or finished but not downloaded) is listed in the popup for 7 days, then removed; users can delete it earlier.
• Uninstalling removes the extension's storage. Files already exported are not affected.
• Nothing exists on our side to retain, export or delete.

Limits worth knowing

• ClarShot adds no encryption on top of the browser's storage. Anyone who can use the device and the browser profile can open its local data, the same as for any extension.
• Browser-internal pages and the store itself cannot be captured; the browser refuses this for every extension, and ClarShot shows a message instead of a blank image.
• The source is not public yet. The checks above do not need it; publishing the core later is on the table.

Documents

Privacy promise and policy · Terms · Legal notice · Questions: support@clarshot.com