What the feedback button records
Updated November 6, 2026
Merle's feedback button is a small script a team adds to its product. People use it to send that team a message. This page lists what the button records, what it never records, who receives it and how long it is kept. Teams can link to this page from their own privacy notices. The privacy policy has the legal detail.
Before anyone presses it
- The button sends Merle nothing and stores nothing on the device. There are no cookies and no local storage, and the only requests are the browser loading the script.
- While the page is open, the script keeps the steps described below in memory, for the last minute only. They leave the page only if the person sends a message and leaves them on.
- Pressing the button creates a random id for this browser in local storage and asks Merle whether this site takes feedback.
- Someone who has already sent a message from this browser stays connected to it. The button asks Merle for news about that message when a page loads.
What goes with a message
A message and its steps go only when the person presses Send. Before they do, the panel names what will go with it, and they can take off the page address and the steps.
| What | Exactly | Can they take it off? |
|---|---|---|
| Their message | What they wrote, up to 2,000 characters | It's the message |
| The page address | The path of the page, such as /settings/billing. No query string, no fragment | Yes |
| The steps | The last minute of activity on the page, listed below | Yes |
| Window size | Width and height in pixels | No |
| Browser id | The random id from the first press, so the button can show them their own messages | No |
| Message key | A random secret made for each message. Merle stores only its hash, and the browser holds the secret so it can ask about that message | No |
| Who they are | Only if the team's product signs them in and passes a signed token: an id, and the name, email address, company and plan if the team includes them | No. The team decides what its token holds |
Taking off the page address removes that line only. The steps can also hold paths, so someone who wants no paths sent takes off both.
The steps
Steps cover the last minute, up to 60 of them. With a screen recording they cover the recording too, up to 200. A path can hold an id if the team's product puts one in its addresses.
| Step | What is recorded |
|---|---|
| A click | A short name for the element: its tag, its id or first class, and its name attribute. Also a button's own label or an element's aria-label, if that is 40 characters or fewer. Links and form labels often show people's data, so they go by the short name alone |
| Typing | The short name of the field and how many characters are in it. The characters themselves are never read |
| Moving to another page | The new path |
| A request from the product | Method, path and status code, for requests to the product's own address or its own subdomains, such as api.example.com. Requests to other sites are left out |
| An error | The message of an uncaught error, up to 300 characters. Query strings, email addresses, long hexadecimal strings and long numbers are removed in the browser first |
Pictures, recordings and voice
These happen only when the person chooses them, each with its own tap.
Add a picture
An image of the visible part of the page. Everywhere a person can type is blurred before the image exists: inputs, text areas, select menus and editable areas, plus anything the team marks with data-merle-mask. Frames the page can't read are blurred whole. Other text on the page still shows, such as names or amounts. The person sees the picture and can blur more of it. It uploads when they press Use this picture, and it is deleted within an hour if no message claims it.
A picture chosen from the person's own files is sent as it is, and the panel says so.
Show me
A recording of this tab, up to 2 minutes, in Chrome and Edge on a computer. The button refuses a whole screen, a window or another tab. It records the tab's picture and, if the person allows the microphone, their voice. It doesn't record the tab's own sound. Places to type are covered with a blur, measured again on every frame, and other text on the tab shows. The person watches the recording and can cut its ends. Nothing leaves until they press Send. The team gets the recording, what was said written out as text, and up to three still frames from it.
Say it
Up to 60 seconds of voice in place of typing. The audio goes to Merle when the person stops, is turned into text and is dropped. The person sees the text and can change it before sending. The team reads the text and never hears the voice.
The blur can't reach closed shadow roots, because a page's scripts can't see inside them. That is why the person is shown every picture and recording before it goes.
What it never records
- What someone types into the team's product. The button records its length.
- Request or response bodies, request headers, cookies or query strings.
- Requests to other sites.
- Mouse movement, scrolling or key presses, unless someone chooses to record the tab with Show me.
- Other tabs, windows or apps.
- The browser's name or version. Window size is the only thing it sends about the device.
- Anything for advertising or analytics. The button sets no cookies.
Merle uses the sender's IP address per request, to limit abuse. It isn't stored with the message.
What stays on the device
After the first press, the browser's local storage holds the random browser id and, once they send, the person's own messages and their status, so they can read them there. Session storage holds small flags for that visit, such as whether voice is off. Clearing the browser's site data removes all of it.
Who receives it
| Who | What they get | Where |
|---|---|---|
| The team behind the product | Everything above, in their Merle inbox. They are the controller, and Merle processes it for them | Stored in the EU |
| Cloudflare | Hosting and storage. It also turns voice into text | Stored in the EU; requests are served from the nearest location |
| Anthropic | Anthropic gets the message text, the titles of the team's open requests and its past answers, to sort the message and say it back in one sentence, and nothing else: no names, email addresses, company, plan, pictures or recordings | United States |
| GitHub or Linear | Only if the team connects one and files an issue: the words people sent, the recorded steps and how many people sent it. No names or email addresses | United States |
| Resend | Only if the person asks for updates by email: their address and the email. An email names the team's product and holds no message text | EU |
How long it is kept
- Pictures, recordings and their still frames: deleted 30 days after the request closes.
- Voice sent with Say it: not kept. Voice in a Show me recording is part of that recording, and goes with it.
- Messages and steps: until the team deletes them or deletes its workspace. A deleted workspace can be restored for 7 days and is then erased.
- An email address for updates: until the person stops the emails, or 30 days after their last request closes. The privacy policy has the rest.
Who to ask
The team behind the product decides what happens to its customers' messages, so start with that team for a request about your data. For anything about Merle, write to support@hellomerle.com.
Teams adding the button can read the install docs.