Privacy policy

Effective date: June 5, 2026 · Last updated: July 11, 2026

1. Overview

StepBinder (“StepBinder,” “we,” “us,” or “our”) is operated by StepBinder LLC and provides browser-based software that helps teams turn screen capture into documentation such as knowledge-base articles, SOPs, and change-control packs.

This Privacy Policy is organized in three parts:

• Part I — The StepBinder App: the browser-local documentation tool, including Private Preview builds.
• Part II — The marketing website: our public site at stepbinder.com and related pages.
• Part III — General provisions: rights, international transfers, and contact information that apply across both.

This Privacy Policy describes how StepBinder LLC handles personal information when you use the App or the marketing website. Your use of the Services is also governed by our Terms of Use. If you do not want information processed as described here, do not use the Site or submit personal information to us.

2. Scope

2.1 Definitions

• App — the StepBinder web application you use to capture screens, edit steps, and export documents.
• Marketing website (or Site) — our public marketing and informational pages, including the Preview waitlist.

2.2 Data controller and processor

For applicable privacy laws, StepBinder LLC is the data controller for personal information collected through the marketing website and for any waitlist or contact data we receive directly.

When an organization uses the App for its users, that organization is typically the controller of account and identity information about its staff (such as work email, user identifiers, and organization membership). StepBinder acts as a processor of that identity data to provide sign-in, sessions, and plan entitlements — including through our authentication and hosting providers. The App’s documentation workflow, by design, does not send your captures or exports to StepBinder, and that documentation content is not processed by us as a hosted content repository.

Organizations that need a Data Processing Agreement for in-scope identity and account data may request one. A DPA is not required for documentation content that never leaves the user’s device in normal use.

2.3 Not legal or medical advice

This policy describes our privacy practices. It is not legal advice, and it does not certify StepBinder for any specific regulatory framework. Organizations that handle personal, confidential, or regulated information remain responsible for their own compliance programs, policies, and downstream handling of exported files.

2.4 Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Our Terms of Use require users to be at least 18 (or the age of majority where they live). If you believe a child has provided personal information to us, contact us at hello@stepbinder.com and we will delete it.

Part I The StepBinder App

The App is local-first. In normal use, documentation you create — screenshots, annotations, notes, and exports — stays on your device. We do not operate a cloud repository of your documents. Signing in is required to access the App (for access control and plan entitlements). Sign-in does not upload your captures, drafts, or exports to a StepBinder document cloud — those stay on your device until you export them.

3.1 What we do not collect

When you use the App in its standard workflow, StepBinder does not:

• upload your screen captures, session data, or exported documents to StepBinder servers;
• run analytics, error reporting, or AI analysis on your document content;
• sync your work to a vendor-operated document workspace.

Loading the App from our hosting provider delivers static application files over HTTPS, similar to downloading software. That delivery does not include the content of what you document.

3.2 What stays on your device

The App stores information locally in your browser and on storage you choose when saving or exporting files. Depending on your settings and usage, this may include:

• screen captures and edited steps held in browser memory during an active session;
• autosaved sessions, recent-session thumbnails, and settings stored in the browser’s IndexedDB;
• preferences and feature flags in localStorage (for example, offline-mode status);
• optional profile fields you enter in the App (such as author name or company logo); and
• files you export or save — PDF, Word, HTML, or .stepbinder session files — to locations you select on your device or network.

Autosaved App data in IndexedDB is encrypted at rest using AES-256-GCM with keys bound to your browser on that device. Exported files are not encrypted by StepBinder unless your organization applies its own storage or device encryption.

3.3 Limited network activity

Even though your documentation stays local, the App may make limited network requests, including to:

• download or update App files from our hosting provider;
• load bundled example templates shipped with the App;
• support optional offline mode after an initial load;
• authenticate the user and load plan/entitlement information at App load (via our authentication provider); and
• process purchases or subscription changes when you upgrade (via our payment provider), typically outside the capture/edit workflow.

These requests do not transmit your captures or finished documents as part of the core workflow. You can enable offline mode so ongoing work does not require an internet connection after the App has loaded.

When the App (or its static files) is requested from our hosting or content-delivery providers, those providers may automatically log technical data — such as IP address, browser type, requested URL, timestamp, and HTTP status — for security, delivery, and reliability. Those logs do not include your documentation content.

3.4 App access

Access to the App requires signing in (for example with email and password, or SSO where enabled for an organization). We use an authentication provider to manage identity and sessions. The personal information involved is limited to account and authentication data (such as email, user identifiers, organization membership, and session metadata). Session credentials authenticate the user; they do not contain your documentation content.

3.5 Local storage and similar technologies

The App uses browser storage — including IndexedDB and localStorage — to save sessions and settings on your device. These are not website “cookies,” but they serve a similar persistence function. You can clear them at any time through your browser’s data settings, which will remove locally stored App sessions and preferences.

3.6 Your content and sensitive information

You control what appears on your screen and what you export. Screen captures may contain personal, confidential, or regulated information depending on your environment. StepBinder provides manual redaction tools, but does not automatically detect or remove sensitive data.

You are responsible for:

• determining whether StepBinder is appropriate for your environment and policies;
• reviewing captures before export;
• using redaction where required; and
• securing devices, exports, and shared files according to your organization’s rules.

If you export or email files outside the App, those actions are outside this policy and subject to the practices of the systems you use.

3.7 Data retention (App)

App documentation and autosaved sessions remain on your device until you delete them, clear browser storage, or remove App data for that browser profile. StepBinder does not hold copies on our servers because that content is not uploaded in normal use.

3.8 Security (App)

We deliver the App over HTTPS and encrypt autosaved data at rest in IndexedDB using AES-256-GCM. Because documentation lives on your device, your organization’s endpoint security — device login, disk encryption, MDM policies, and export controls — is an essential part of protecting sensitive information. You are responsible for using redaction tools where appropriate before export and for choosing secure destinations for exported files.

Part II The marketing website

The marketing website at stepbinder.com works like a conventional site. When you browse it, submit the Preview waitlist, or contact us, StepBinder and our service providers may process limited personal information as described below.

Nothing you type into the App’s documentation workflow is sent to us through the marketing website.

4.1 Preview waitlist

If you request access to the StepBinder Preview, we collect the information you submit, which typically includes:

• name;
• work email address;
• company name;
• job function or role (from a fixed list you select); and
• technical metadata such as submission time and referring page URL.

Waitlist submissions are added to our Clerk waitlist so we can approve Preview invites from one place. Name, company, and role may also be sent to an internal webhook or inbox we operate for review context.

Waitlist form contents are not sent to Google Analytics or similar analytics tools.

4.2 Analytics

We use Google Analytics on the marketing website to understand aggregate traffic — for example, page views, approximate geography, device type, and referral source. Google may set cookies or use similar technologies as described in Google’s Privacy Policy.

We do not use analytics in the App to track document content. The Site does not currently present a separate cookie-consent banner before loading analytics. You can limit analytics collection through browser settings, ad/tracking blockers, or Google’s opt-out tools where available.

4.3 Security checks (CAPTCHA)

We may use a CAPTCHA provider — such as Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA — on the waitlist form to reduce spam and abuse. Those providers may collect device and interaction signals needed to perform the check. Their use is governed by their respective privacy policies.

4.4 Hosting and server logs

The marketing website is served through hosting and content-delivery providers (for example, Vercel). Like most websites, they may automatically log technical data when you visit — such as IP address, browser type, requested URL, timestamp, and HTTP status. We use these logs for security, reliability, and troubleshooting of the Site.

4.5 Contact and support email

If you email us at hello@stepbinder.com or otherwise contact us through the Site, we receive the information you choose to send (such as your name, email address, and message contents) so we can respond.

4.6 How we use website information

We use information collected through the marketing website to:

• review Preview waitlist requests and send invitations;
• respond to questions, support requests, and feedback;
• monitor Site performance, security, and abuse prevention;
• improve the marketing website; and
• send service-related messages (for example, Preview invites).

We do not sell your personal information. We do not use waitlist data for cross-context behavioral advertising.

4.7 Sharing and service providers

We do not sell personal information, and we do not share customer or waitlist information with third parties for their own marketing, advertising, or other independent use.

We use a small number of service providers who process limited information on our behalf solely to operate the marketing website and Preview waitlist. They are not permitted to use that information for their own purposes beyond providing the service to us. Depending on how the Site is configured, these may include:

• Identity and access (Clerk) — to manage Preview waitlist entries and invite-only sign-in;
• Form processors (for example, Formspree) — to receive and relay general contact messages when configured;
• Analytics providers (for example, Google Analytics) — to measure aggregate Site traffic;
• CAPTCHA / abuse-prevention providers (for example, Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA) — to reduce spam on the waitlist form; and
• Hosting and content-delivery providers (for example, Vercel) — to serve the Site and App files and related infrastructure, which may generate technical server logs.

We may also disclose information if required by law, to protect the security of the Services, or in connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards.

App documentation content is not uploaded to StepBinder in normal use and is therefore not shared with these providers.

4.8 Cookies on the marketing website

The marketing website may set cookies including:

• analytics cookies set by Google Analytics when the Site loads.

Most browsers let you block or delete cookies. Blocking cookies may affect Site analytics but does not change the local-only design of the App’s documentation workflow. Where a jurisdiction requires prior consent for non-essential analytics cookies and we have not implemented a consent mechanism, you should use browser or Google opt-out controls, or avoid browsing the Site if you do not want analytics cookies set. App sign-in cookies, when used, are described under App access and are set in connection with authenticating to the App, not as marketing analytics.

4.9 Data retention (marketing website)

• Waitlist and contact records are kept as long as needed to manage Preview access and communicate with you, then deleted or anonymized when no longer needed unless law requires longer retention.
• Analytics data is retained according to our analytics configuration and Google’s settings.
• Server logs for the marketing website are kept for a limited period for security and operations, then rotated or deleted.

Part III General provisions

5.1 Your privacy rights and choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you; to object to or restrict certain processing; and to withdraw consent where processing is consent-based.

To exercise these rights, email hello@stepbinder.com. We may need to verify your request. We will respond within the timeframe required by applicable law.

Note about the App: because your documentation stays on your device, StepBinder generally cannot access, export, or delete App session content on your behalf. You can remove it by clearing browser storage on your device.

5.2 United States state privacy laws

Residents of California and certain other U.S. states may have additional rights, including the right to know categories of personal information collected, to request deletion, and to opt out of “sales” or “sharing” for cross-context behavioral advertising. StepBinder does not sell personal information or share it for cross-context behavioral advertising as those terms are commonly defined.

You may designate an authorized agent where your state law allows. We will not discriminate against you for exercising privacy rights.

5.3 Legal bases (EEA, UK, and Switzerland)

Where the GDPR or similar laws apply to marketing website data, we rely on the following bases:

• Contract — to provide Preview access or respond to requests you submit.
• Legitimate interests — to secure our services, prevent fraud and abuse, operate and improve the marketing website, measure aggregate Site traffic where permitted, and communicate about the Preview, balanced against your rights.
• Consent — for non-essential promotional emails where we ask for consent; you may withdraw consent at any time. We do not currently rely on cookie consent for Site analytics because we have not implemented a consent banner; see Sections 4.2 and 4.8 for how analytics works and how to opt out.
• Legal obligation — where we must retain or disclose information to comply with law.

5.4 EEA / UK complaints

If you are in the EEA or UK and believe we have not addressed your concern, you may lodge a complaint with your local supervisory authority.

5.5 Marketing communications

You can opt out of non-essential promotional emails by using the unsubscribe link in a message or by contacting us. We may still send transactional or service messages related to Preview access.

5.6 International transfers

StepBinder is based in the United States. If you access the marketing website from outside the U.S., your information may be processed in the U.S. and other countries where our service providers operate. Those countries may have data-protection laws that differ from yours. Where required, we use appropriate safeguards such as standard contractual clauses for transfers of personal data.

5.7 Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice on the marketing website. The updated policy applies to information we process after the effective date of the change.

5.8 Contact us

Questions about this Privacy Policy or our privacy practices:

StepBinder LLC
Email: hello@stepbinder.com
Web: https://www.stepbinder.com

See also: Terms of use