Demoman privacy policy

Effective: October 22, 2026 · Contact: privacy@demoman.io

Demoman is operated by Yohana Tesfazgi.

Demoman is a tool your coding agent uses to make demo videos of web apps, in a browser of its own on your computer. This policy covers that tool (the demoman package on npm) and the demoman.io website: what they handle, where it goes, and what you control.

The short version

• Demoman keeps what it records on your computer.
• Demoman sends nothing to us. Once a day it asks npm whether a newer version exists, and you can turn that off.
• A video goes to GitHub only when your agent attaches it to a pull request, which Demoman tells it to do only when you ask or a setting allows it.
• Your coding agent reads what Demoman reports, such as the text on the pages it records, and passes it to the AI service it runs on.
• The website keeps your email address only if you ask for launch news.

What Demoman handles

Recordings. When your agent makes a demo, Demoman opens the pages it asks for, records them, and notes each step: what was clicked, what was typed, and where each thing was on the page. Each recording is kept in ~/.demoman/takes on your computer, with any edits you make to it in the studio, and grouped into videos listed in ~/.demoman/videos. With each recording Demoman notes who made it: your computer's user name, your project's folder, its git remote (without any password or token in it), branch and commit, and your agent's name. A recording's video frames are removed after 30 days, unless it is the newest complete recording of its video, you edited it, your newest export came from it, or it could not be recorded again; its steps stay until you delete them. Every video, GIF and image Demoman exports carries the ids of its video and recording inside the file. Videos you export are saved as files in your Downloads folder, or in a folder set for your agent's exports.

Sign-ins. When you run npx demoman signin <url>, you sign in yourself in a window Demoman opens. Demoman saves that site's session (its cookies and site storage) in ~/.demoman/sessions, readable only by your user account. It never saves the password you typed.

Demo accounts. For an app you run on your own computer, your agent can create a demo account. It writes the sign-in steps to .demoman/accounts.json in your project and the password to .demoman/secrets.env, which Demoman uses only while git ignores it. Demoman signs in to a demo account in a hidden window that is not recorded.

Passwords. Demoman does not keep text typed into password fields in its recordings or reports, and it writes a demo account's password only as its name. The video shows what the page shows: a password field shows dots, as it does for anyone, and nothing else is covered unless you add a Mask in the studio.

The studio. The studio keeps its settings (its theme, export quality and your pull-request video setting), your brand kits and their logo images, its own browser profile and a log in ~/.demoman. It serves its pages only to your own computer, behind a key it makes each time it starts.

What leaves your computer

To us: nothing. Demoman has no analytics, crash reporting or tracking, and does not send your recordings, typing or browsing to its publisher.

To npm, GitHub and Playwright. Setup downloads the browser Demoman records with from Playwright's servers, and Claude Code and Codex fetch the Demoman plugin from GitHub, and check GitHub again in the background for a newer plugin, which they install. Your agent starts Demoman through npx, which asks npm for the newest version each time and fetches it. Once a day, Demoman asks npm whether a newer version exists; the request carries nothing about you beyond what any web request does. Set DEMOMAN_NO_UPDATE_CHECK=1 to turn it off.

To GitHub, for pull requests. When your agent attaches a video to a pull request, the GitHub CLI (gh) uploads it as your GitHub account, and anyone who can see that pull request can see the video. Added as a comment, it carries one line naming the recording. The setting is Ask by default, and then Demoman tells your agent to offer a video before attaching one; set to Off, to attach a video only when you ask; set to Attach, to attach without asking. Demoman cannot enforce this: your agent decides. You choose the setting in the studio, and a repository can choose it for everyone who works in it, with a .demoman/config.json file.

To the sites your agent opens. Demoman's browser visits the pages your agent asks for, as any browser would, signed in only where you or a demo account signed it in.

To your coding agent. Once setup has connected Demoman to Claude Code, Codex or Cursor, your agent can use it on any site without asking: setup approves Demoman's tools in each agent, and says so (the Cursor app may still ask once per tool). Your agent can receive: the text and position of the buttons, links and fields on pages it looks at; the steps of its runs and how each went, including the text it typed; the list of your recordings; which sites you have saved sign-ins and demo accounts for; where an exported video is saved; your pull-request video setting, and the address of a pull request and video it attached; and a link that opens the studio once. Demoman does not send it the video, though an agent with access to your files can open it.

The agent passes what it receives to the AI service it runs on (by default, Anthropic for Claude Code and OpenAI for Codex; for Cursor, Cursor and the model provider you choose there). That service's own privacy policy applies to it. Demoman does not choose the service and cannot control what it does with the data. When your agent creates a demo account, it chooses the password, so that service has the password too.

The demoman.io website

Launch news. When you ask for launch news, demoman.io stores your email address and when you asked, in a database hosted by Cloudflare. It is used only to tell you when Demoman launches. To have it removed, write to privacy@demoman.io.

Visits. demoman.io uses Cloudflare Web Analytics to count visits, including visits to demoman.io/sample, the sample app setup suggests trying. It sets no cookies. Cloudflare serves the site, and like any web host it handles your IP address to deliver the pages.

Your control

• Delete a recording in the studio's library or by deleting its folder in ~/.demoman/takes, or everything Demoman keeps by deleting ~/.demoman.
• Sign Demoman out of a site by deleting its file in ~/.demoman/sessions.
• Stop your agent using Demoman with claude plugin uninstall demoman@demoman in Claude Code, codex plugin remove demoman@demoman in Codex, or, in Cursor, by removing the demoman entry from ~/.cursor/mcp.json and the ~/.cursor/skills/record-demo folder.
• Keep your agent from attaching videos unasked by leaving the studio's Pull requests setting on Ask, or setting it to Off, in a repository whose .demoman/config.json does not set it to Attach.
• The browser setup downloaded is in Playwright's cache (~/Library/Caches/ms-playwright), and can be deleted with it.
• Videos you exported are ordinary files where they were saved, and stay there until you delete them.

Changes

If Demoman starts handling data in a new way, this policy is updated and its effective date changes.

Contact

Questions about this policy: privacy@demoman.io.