Privacy Policy
Lens by Vectored · Last updated: August 2026
The short version. Lens has no account, no server and no analytics. As installed it makes no network requests at all. Your captures, your project folders and your settings stay on the machine that made them, and Vectored never receives any of it — that last part stays true no matter what you turn on. The one thing that can change it is you connecting an AI provider of your own, which is off by default and covered in section 7.
1. Who this covers
This policy covers the Lens browser extension for Chrome, published by Vectored. It does not cover the documentation site you are reading, which is covered by the site privacy policy.
2. What Lens does not collect
Lens does not collect, transmit or receive any of the following:
- Your screenshots, recordings or any part of them
- The pages you visit, their titles, URLs or contents
- Your project names, folder names or folder paths
- Usage analytics, telemetry, crash reports or feature counters
- An email address, name, account or device identifier
- Cookies or any advertising or tracking identifier
The extension contains no analytics SDK, no remote configuration and no update-check call of its own. Extension updates are delivered by the Chrome Web Store, not by us.
This list is about Vectored, and it holds unconditionally. If you connect an AI provider, Lens talks to that provider using your key — not to us, and we learn nothing about it. See section 7 and the AI features documentation.
One thing to be clear about: this documentation website is not Lens. The site you are reading right now (docs.vectored.dev) uses cookieless analytics to count page views, described in the main privacy policy. That measures documentation pages only. It collects nothing from the Lens extension, sees none of your captures, projects or settings, and does not change anything above — installing and using Lens still sends us nothing.
3. What is stored, and where
Everything Lens stores is local to your browser profile or written to a folder you chose. Nothing is stored by Vectored.
| What | Where it lives | Why |
|---|---|---|
| Captures — .png, .jpg, .gif, .mp4 | The project folder you picked, or your Downloads folder as a fallback | They are the product of the tool |
| project_metadata.json — file name, page title, page URL, timestamp, captured region, your note | Alongside the captures, in the same folder | So the capture set is self-describing and readable by other tools |
| Project list and folder handles | IndexedDB in your browser profile | To reopen your folder without asking you to pick it every time |
| Settings | chrome.storage.local | To remember your preferences |
| AI prompts and responses | Nowhere — held in memory for the length of the request | They are not needed after the answer arrives |
| AI provider API key, only if you set one | chrome.storage.local, in its own area, separate from your settings | So Lens can reach the provider you chose. Written by the settings screen, read only by the background worker, never by page-injected code |
| Preview thumbnails, capped and downscaled | chrome.storage.local | So the timeline renders without reading every file from disk |
| In-progress recording state | chrome.storage.session | So a recording survives navigation; cleared when the browser closes |
4. Access to your file system
Lens uses the browser's File System Access API. This has specific and deliberately narrow properties:
- Lens can only read or write inside folders you explicitly picked in the browser's own folder picker. It cannot browse your disk, and it cannot reach a folder you did not choose.
- Permission is granted per folder and can lapse — after a browser restart, for example. Lens cannot restore it silently; it needs a click from you.
- Revoking access is done in Chrome, under the site and extension permission controls, and takes effect immediately.
If no folder is linked, or access has lapsed, captures fall back to your Downloads folder under Lens-Captures/. The extension tells you when this happens rather than failing quietly.
5. Access to page content
To draw the selection overlay and capture a region, Lens injects its capture interface into the tab you are capturing — but only at the moment you start a capture, and only into that tab. There is no content script running in the background on every page you visit.
Captured pixels are held in memory long enough to crop, annotate and encode them, then written to your chosen folder. They are not copied anywhere else.
6. Redaction
Before a capture is saved, Lens checks the captured region for things that usually should not be shared — password fields, API keys, tokens, private keys, and optionally emails and card numbers — and offers to blur each one. That check reads the page structure in your own browser. It uses no AI, makes no network call, and is on by default. It only ever suggests: nothing is blurred until you ask for it.
The blur tool rewrites the underlying image data rather than drawing an opaque shape over it. Once a blurred capture is saved, the original pixels are not recoverable from that file by removing a layer. This is intentional: a redaction that can be peeled off is not a redaction. Check the result before saving, because it cannot be undone after the fact.
7. AI features and your own provider
Every AI feature is off when you install Lens. Until you pick a provider, none of this applies and Lens makes no network requests.
Lens has no AI service of its own and never will — there is no Vectored model, no Vectored endpoint and no Vectored proxy in the path. Instead you choose who does the work, and the choice determines whether anything leaves your machine:
| Provider you choose | Where it runs | What leaves your machine |
|---|---|---|
| None — the default | Nowhere; AI features are off | Nothing |
| Your browser's built-in model (Edge, Chrome) | On your device, inside the browser | Nothing |
| A model on your machine (Ollama, LM Studio) | On your device, on a port you name | Nothing |
| Claude (Anthropic) or OpenAI | That company's servers | The prompt for the feature you enabled, sent directly from your browser using your API key |
Choosing a provider that runs in the cloud asks you to confirm first, because it genuinely changes what the extension does.
What is actually sent
Only what the feature you pressed actually needs, and never the thing a feature is protecting. Each feature is listed below with exactly what its prompt carries. Captured images are not sent to any provider.
| Feature | How it runs | What the prompt contains |
|---|---|---|
| Sharpen the private-data check | Automatically, only if you switch it on | The type of each flagged region — "an AWS access key", "a password field" — plus the page title and heading. Never the flagged text itself. |
| Suggest name & description | A button you press, per capture | The page title and heading, the names of controls in the region, and the text inside the region you captured — describing a screenshot is the task, so this one needs its content. |
| Write steps from clicks | A button you press, per recording | The page title and the names of the controls you clicked, as a screen reader would announce them. Never anything you typed into a field. This feature also works with no provider at all, from the click list alone. |
The distinction is deliberate. Sending an API key to a model to ask whether it is an API key would defeat the point of the check that found it — so the check never does. Asking a model to describe a screenshot without giving it the content would be pointless, so that one does, and it only ever happens because you pressed the button on the capture in front of you.
Captured images are not sent to any provider.
Your API key
- It is stored in your browser profile, in its own storage area, separate from your other settings.
- It is only ever read by the extension's background worker, never by the code Lens injects into a page — that code shares a process with the page, so a key must not be readable there.
- The settings screen can tell you a key is saved but cannot show it back to you.
- It is sent only to the provider it belongs to. Vectored never receives it, and there is nowhere for it to be sent to us.
- Clearing the field removes it; uninstalling the extension removes it along with everything else.
Whose policy applies
Once a prompt reaches a hosted provider, that company's privacy policy and terms govern it, including how long they keep it and whether they train on it. That relationship is between you and them — you supplied the key, you chose the provider, and Vectored is not a party to it and cannot see it. Check their terms before enabling a cloud provider on work that is confidential.
What Lens itself keeps
Nothing. Prompts and responses are held in memory for the length of the request and are not written to disk, to extension storage or to a log. Generated text becomes yours the moment it lands in a field you can edit — Lens keeps no separate copy of it, and no record that a feature was used.
Accuracy
Generated text can be wrong, and the private-data check finds known shapes rather than everything that might be sensitive. Neither is a guarantee, and neither removes your responsibility to read a capture before you share it. See the AI features documentation for what each feature does and does not do.
Turning it back off
Setting the provider back to None stops every AI feature immediately and returns the extension to making no network requests. Clearing the API key field removes the key. Neither affects any capture you have already saved.
8. Third parties
Lens bundles no third-party analytics, advertising or error-reporting service, and loads no code at runtime from any remote origin. As installed it sends nothing to anyone.
The one third party Lens can ever talk to is an AI provider you chose and configured yourself, and only for a feature you turned on — see section 7. There is no third party Lens contacts on its own initiative.
If you choose to contact us through the support form, that is a separate, voluntary act: only what you type into the form is sent, and only then. The extension is not involved.
9. Retention and deletion
- Captures and metadata are ordinary files. Delete them as you would any file; Lens keeps no second copy.
- Cached thumbnails can be cleared from the dashboard under Settings, without touching the files on disk.
- Projects, settings and folder handles are removed when you uninstall the extension, along with everything else in its browser storage.
Because Vectored holds none of your data, there is nothing for us to delete on request and no data export for us to produce — you already hold the only copy.
10. GDPR and international transfers
Lens performs no processing of personal data on behalf of Vectored: no personal data is transmitted to or held by us, and as installed there is no international transfer of your data because there is no transfer at all. Where you capture content containing personal data, you remain the controller of the resulting files, which stay on infrastructure you control.
If you connect a cloud AI provider, you are the one instructing a processor of your choosing, under your own account with them. Vectored is not a party to that arrangement and cannot see it — but it is a transfer, and if the content is subject to GDPR it is yours to assess.
11. Children's privacy
Lens is a developer and documentation tool, not directed at children, and collects no personal information from anyone.
12. Changes to this policy
If this policy changes, the updated version will be posted here with a new "Last updated" date. Any change to what can leave your machine will be called out in the extension's release notes, not only here — and any new way for data to leave will arrive switched off, the way the AI providers in section 7 did.
13. Contact
Questions about this policy: support@vectored.dev, or use the support form. For security reports, see the security page.