Spitfire Recorder privacy policy

Effective: 7 November 2026

This policy covers the Spitfire Recorder Chrome extension. The extension records a flow you go through in the browser and imports it into your organization's own Spitfire installation as a load test. It contains no analytics or telemetry, does not track you and sends nothing to Albiferro.

What it records

It records the requests and responses (address, headers, bodies) of the browser tab you choose, only between Start recording and Stop. While recording, Chrome shows a bar saying the extension started debugging the tab; the bar goes away when the recording stops. Other tabs and the time outside a recording are not recorded.

Masking

Before the recording goes anywhere, passwords, Authorization and API key headers, card numbers and Turkish ID numbers are masked in your browser, and cookies are dropped. Only a response cookie a later request sends back outside the Cookie header (in a header or the body) stays in the recording, for correlation.

Where it stays and where it goes

• A finished recording waits in the extension's own browser storage until you send, download or discard it.
• The recording is sent only to the Spitfire address you enter in the extension's settings, over HTTPS (http only to localhost). That address is your organization's server; your organization is responsible for the data there and Albiferro cannot access it.
• The Spitfire address and the optional API token are kept only in your browser (chrome.storage.local). Removing the extension deletes all of it.

Permissions

• debugger: to read the requests and responses of the recorded tab, only while recording; the correlation values are in the response bodies.
• activeTab: to read the address and title of the tab the recording starts in (default domain and test name).
• storage: to keep the Spitfire address, the API token and, while recording, the recording state in this browser.
• Site access (optional): asked once, only for the Spitfire address you enter; no other address is contacted.

Sharing, children, changes

Albiferro receives no data from the extension, and does not sell or share any with third parties. The extension is for business use and not directed at children. If this policy changes, the new version is published on this page with its effective date.

Contact

For questions: the contact address at the bottom of the page. For the recordings on your Spitfire installation, contact your organization's Spitfire administrator.