Recording on your computer
Projects, .story scripts, recordings and exports are files on your computer. Nothing leaves it until you upload a video.
A story records only its own browser window, not your screen. Fields named in a redact line are masked from the first frame, not blurred afterwards.
Sign-in values a story uses are saved as named secrets, encrypted with your operating system's keychain, and never written into the script.
The MCP server
It is off until you turn it on in Settings, listens only on your computer and answers only clients that send its token. A new token revokes the old one.
Recording, uploading and changing which version of a video plays ask you in the app first, unless you turn on Full access.
The web app and sharing
You sign in with Google or GitHub; StoryCapture stores no passwords.
Uploaded videos stay private to your workspace until you share a link. Workspace members are owners, editors or viewers.
API tokens for unattended uploads are stored hashed, scoped to uploads, and can expire or be revoked.
Watch analytics use a random session id and the viewer's country. The IP address is not stored, and raw events are kept for 90 days.
Services we use
| Service | What for |
|---|---|
| Vercel | Hosts the web app |
| Supabase | Database |
| Cloudflare R2 | Stores uploaded videos |
| Resend | Sends invitations and waitlist notices |
| ElevenLabs, Anthropic, OpenAI | Only with your own key, under your account |
Deleting data
Delete a video or one of its versions on its page. To delete your account and everything in it, write to hello@storycapture.dev.
Reporting a security issue
Write to hello@storycapture.dev with what you found and how to reproduce it.