Privacy policy

1. Who we are

stepkeep is published by GRAN Software Solutions GmbH, Am Hamburger Bahnhof 3 c/o Glazewski, 10557 Berlin, Germany, registered at Amtsgericht Berlin Charlottenburg under HRB 245105 B and represented by its managing directors Grzegorz Glazewski and Dusan Odalovic. We are the controller for the data described on this page.

You can reach us at hello@gransoftware.de or through https://gransoftware.de.

2. The extension: nothing leaves your machine

stepkeep records a task in your browser. You press record, do the task, and press stop. Every click and typed field becomes a numbered step with a screenshot. You edit the guide and export it as PDF, HTML or Markdown.

The extension makes no network request at all. Not while recording, editing or exporting, and not when you enter a licence key. There is no stepkeep account and no stepkeep server, so nothing you record can leave your machine. There is no telemetry, no crash reporting and no analytics in it, and nobody at stepkeep can see your guides.

What it records

• Screenshots. A picture of the visible part of the tab, one per step. A screenshot shows whatever is on screen, including anything you typed, so treat a guide the way you would treat a screen recording.
• Step sentences. Written from the clicked element's own label and a heading near it, never from what you typed. The recorder does not read form values, passwords, cookies or query strings.
• Page details. The page address without its query string, and the page title.
• Your branding. The name, footer, colours and logo you choose for your exports.
• A licence key, if you paste one.

Where it is kept

All of it sits in your browser profile on your own device, in the extension's own storage. Exports are files you save yourself, and they stay wherever you put them. On a managed computer, an administrator can push a corporate design to the extension through the browser's own policy; the extension reads it and sends nothing back.

The permissions it asks for

How to delete it

Delete a guide in the extension popup and it is gone, screenshots included. Remove the licence key with Remove key in the Licence panel. Uninstall the extension and everything it stored goes with it. There is no other copy anywhere, because nothing was ever sent to us.

3. Buying a licence

You buy on our website, not in the extension. Stripe runs the checkout as the seller of record, so your card and billing details go to Stripe and are handled under Stripe's privacy policy. We never see your card.

What reaches us is that an order was completed, the email address it was placed with, and the plan that was bought. We use that to create your licence key and email it to you.

We keep one record per order: the email address, the order reference, the plan and number of seats, the key we issued, and when we created and sent it. It is stored with Scaleway in Paris, in the European Union, encrypted at rest, under a data processing agreement. The email itself goes out through Scaleway's email service.

We need that record to deliver what you bought (Art. 6(1)(b) GDPR). Keeping it afterwards, so we can replace a lost key, answer a support question and prove the sale, is our legitimate interest (Art. 6(1)(f) GDPR).

We keep it for as long as the licence can be used, which is indefinitely because a key never expires, and at least for the ten years German tax law requires for records of a sale. Ask us to erase it earlier and we will, except where we must keep proof of the purchase. Erasing the record never disables a key you have paid for.

4. Visiting this website

The extension is one thing and this website is another. Here is what the site does.

Visit counts

This site counts its visits with umami, an open-source counter we run on our own servers in the European Union. Each visit records the page address, the page you came from, the page title, the language and screen size your browser reports, and the browser, system and rough region worked out from your IP address. It also records simple loading-speed timings, such as when the largest element appeared and how much the layout shifted. The IP address itself is not stored: it is turned into a one-way value with a secret that changes every day, so a visit today cannot be linked to one yesterday. If your browser sends a Do Not Track signal, nothing is counted at all.

No cookie is set and nothing is written to your device, which is why there is no consent banner: § 25 TDDDG asks for consent before something is stored on or read from your device, and this counter does neither. The counting rests on our legitimate interest in knowing whether these pages are read (Art. 6(1)(f) GDPR). Once the day's secret is gone, the counts lead back to nobody, so there is nothing in them to look up, correct or delete for you.

The launch list

If you ask us on this site to tell you when stepkeep launches, we keep your email address, the time and page of the request, the version of the consent text you agreed to, and a one-way value derived from your IP address, never the address itself. You confirm the address by clicking a link in one email; until you do, you are not subscribed. The list is stored with Scaleway in Paris, with a copy in Amsterdam, both in the European Union, and an entry expires after two years.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email we send, which removes your entry at once.

5. Your rights

For any personal data we hold about you, you can ask us to tell you what we hold and give you a copy, to correct it, to erase it, to restrict what we do with it, and to hand it over in a portable format. You can object to any processing we base on legitimate interest, and where we rely on your consent you can withdraw it at any time (Art. 15 to 21 GDPR). Write to hello@gransoftware.de and we answer within a month.

You can also complain to a data protection authority. The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, datenschutz-berlin.de. You may instead complain to the authority where you live.

You do not have to give us any data to use the extension. To buy a licence we need an email address to send the key to, and nothing else. We make no automated decisions about you and we build no profiles.

6. Changes and contact

We update this page when the extension or the site changes what it handles, and the date at the top changes with it. If a change affects what the extension records, we say so in the release notes for that version.

Questions about this policy or about your data go to hello@gransoftware.de, or by post to GRAN Software Solutions GmbH, Am Hamburger Bahnhof 3 c/o Glazewski, 10557 Berlin, Germany.