Question 1

Where are recordings stored?

Accepted Answer

In your own browser storage, on your machine. The video blob lives in IndexedDB and never leaves the device unless you export it yourself. The server holds your account details (name, email, role) and, separately, whatever mail and webhook traffic you deliberately send to the Mail and Webhook Inspectors. It never holds a capture.

Question 2

What exactly ends up in a capture?

Accepted Answer

Clicks with their coordinates, keyboard input collapsed per field, navigations, tab and window switches, timestamped screenshots, and any API calls on the hosts you chose to watch, each with method, URL, status code and duration. Browser, OS and screen resolution are read from the session automatically.

Question 3

How is sensitive data handled?

Accepted Answer

Fields identified as sensitive (passwords, access tokens and similar) are masked as the step is captured, not scrubbed afterwards. The unmasked value is never written to storage, so there is no version of the capture that contains it.

Question 4

Do I have to record video?

Accepted Answer

No. Screenshot mode captures stills on click, on a two- or five-second cadence, or only when you press Capture Now. That is useful when a full recording would be too heavy or too sensitive to keep, and the better starting point for a written guide.

Question 5

What does the person on the other end actually receive?

Accepted Answer

A PDF or a ZIP, and one of two documents inside it. An issue report carries the annotated timeline, screenshots, network log and a full environment header. A how-to guide drops the diagnostics and leads with your own wording for each step. Both open without CapTrace installed.

Question 6

Do the built-in developer tools send anything anywhere?

Accepted Answer

CapTrace includes a developer toolkit for the work either side of a capture: reading payloads, decoding tokens, converting timestamps, generating test data, testing patterns and comparing text. Every one of them runs entirely in your browser, so what you paste is never uploaded and never logged. The Mail and Webhook Inspectors are the deliberate exceptions and are described separately, because receiving mail and receiving requests is what they are for.

Question 7

How does the disposable inbox work?

Accepted Answer

You take an address, send real mail to it, and read what arrives, either in the app or from your test suite over the API. It is meant for the steps automation normally cannot cross: the verification link, the one-time code, the receipt. Every link in a message is extracted for you, and SPF, DKIM and DMARC verdicts are read off the headers that actually arrived. Addresses are yours alone, and you can discard one the moment a run finishes.

Question 8

Why do I have to ask for the Webhook Inspector?

Accepted Answer

Because it hands you a URL on our domain that accepts requests from anyone on the internet, and that is not something to switch on for an account nobody has looked at. It is granted per account by an administrator, so ask for it when you request access and we will enable it. Everything else in CapTrace is available as soon as you sign in.

Question 9

Can I call CapTrace from CI?

Accepted Answer

Yes, that is what the API keys are for. The Mail Inspector has a versioned API for taking an address and polling for the newest message, and a Webhook Inspector endpoint can expose a lookup URL that returns one captured payload selected by a value your test already knows. Keys are issued from Settings, are scoped to one surface, cannot be used to create another key, and can be revoked without disturbing anything else.

Question 10

How are accounts managed?

Accepted Answer

Through a separate admin console on its own origin, with its own session cookie. Administrators create, rename, suspend and remove user accounts; an end-user session can never be presented as an admin one.