Where your data sits, and who can see it

In Solo mode, the leads you harvest persist in the browser's own extension storage (chrome.storage.local). There is no server, no account, no telemetry — nothing leaves the laptop. In Team mode, leads sync to a Postgres database we host. You can leave Team mode at any time and export the full table to Excel, CSV, or NDJSON.

All harvesting happens in your browser at the speed you drive. There is no headless farm, no third-party proxy, no remote browser in the loop. Calling runs over WebRTC in your own browser; carrier minutes are handled through standard telephony sub-processors.

In transit: TLS 1.3 across every public endpoint. At rest: standard disk encryption on the database host (the host itself, not column-level — column-level encryption for phone numbers is a TODO before launch). Session cookies are httpOnly + secure + sameSite=lax.

Workspaces have four roles — owner, admin, manager, member. Reps see only their own leads; managers see the leads assigned to the team they manage; admins and owners see the whole workspace. There is no implicit cross-workspace visibility — every request is scoped to the workspace in its bearer token.

Every write to a lead, pipeline, view, or workspace setting will be logged with actor, timestamp, before-value, and after-value. Audit logs are on the roadmap for the Team plan — they are not yet shipped. The plan ships with `audit_log` placeholders wired up to the auth layer so the surface is real but the rows are empty.

Email security@scraper.example (placeholder — replace with the real address before launch). We acknowledge within 24 hours and follow up with what we found. We do not run a paid bug-bounty program yet.