Privacy Policy
Effective Date: June 30, 2026 | Last Updated: June 30, 2026
This Privacy Policy explains how BrowserShield(“we”, “our”, or “us”) collects, uses, stores, shares, and protects information when you use the BrowserShield Chrome extension and related services.
1. Information We Collect
A. Personal Information
We collect the following personal information:
- Email address (only when contacting support)
- License key
Purpose: The license key is used to verify your active subscription and authenticate your device. Email is collected only if you contact us for support, solely to respond to your inquiry.
Payment information (card details, billing address) is processed directly by Stripe and is never received or stored by BrowserShield.
B. Browser Data
The extension accesses the following browser data:
- Current tab URL — Sent to our backend for real-time threat classification on every page visit.
- Download metadata (filename, MIME type, source URL) — Sent to our backend for malware reputation checks when a file download begins.
- Webpage text content — When scam or adult protection is enabled, the extension reads the visible text of a page (up to 4,000 characters of
document.body.innerText). If local heuristic keyword matching triggers a suspicion, this text is sent to our backend (and subsequently to OpenAI) for deeper threat classification. This only occurs when the local scan detects potential risk — not on every page. - Form input content — When Data Loss Prevention (DLP) is enabled, the extension reads the values of visible form fields (excluding password fields) at the moment of form submission. This data is scanned locally on your device using pattern matching to detect sensitive data leakage (e.g. credit card numbers, national ID numbers). It is not transmitted to our servers.
- Clipboard / paste data — When clipboard protection is enabled, the extension reads text that you paste into a page via the browser's paste event. This data is scanned locally on your device for sensitive patterns. It is not transmitted to our servers.
The extension does not access browsing history, cookies, or search queries.
Storage: URLs, download metadata, and webpage text sent to our backend for analysis are discarded immediately after the check completes. BrowserShield does not intentionally store this data in its application database or application logs. Only the resulting threat classification (e.g., safe, phishing, malicious) may be cached locally within the extension for the current browser session to avoid redundant checks. This local cache is cleared when the browser closes.
IP addresses: As with any standard HTTPS communication, your IP address may be seen by our servers as part of the underlying network request. We do not log, store, or use IP addresses to identify you.
C. Device Information
The extension generates and transmits the following device data during license activation:
- A randomly generated device identifier — created locally using a cryptographically secure random number generator when the extension is first installed. This is unique per Chrome profile.
- A device fingerprint — a non-reversible numeric hash derived from hardware characteristics: screen resolution, GPU renderer string, CPU core count, and system timezone. This is used to recognise the physical machine and allow multiple Chrome profiles on the same device to share a license.
Purpose: These identifiers are used solely to enforce the per-device subscription limit. A single license covers one physical machine; multiple Chrome profiles on that device are permitted. Neither identifier contains your name, email address, browsing history, or any personally identifying information.
These identifiers are not used for advertising, behavioural analytics, or cross-site tracking of any kind.
D. Usage Information
We do not collect crash reports, diagnostic logs, performance metrics, analytics, or any other usage telemetry. No behavioural data is collected or transmitted.
2. How We Collect Information
Information may be collected:
- Automatically while using the extension (URL and download checks during normal browsing)
- When activating a license (license key and device identifier submitted during activation)
- When contacting customer support (email address collected only if you write to us)
- When purchasing a subscription (payment is processed directly by Stripe; BrowserShield does not receive or store payment card details)
3. How We Use Information
We use collected information to:
- Provide extension functionality (real-time threat detection and blocking)
- Detect malicious or unsafe websites and downloads
- Verify subscriptions
- Enforce license limits (one device per license)
- Respond to support requests
- Prevent abuse or fraud
- Comply with legal obligations
We do not use collected information for advertising, behavioral profiling, or any purpose not listed above.
4. Chrome Permissions
The extension requests the following permissions. Each is used only for its stated purpose:
| Permission | Why It Is Needed |
|---|---|
| webNavigation | To intercept and evaluate each page URL before navigation completes, enabling real-time threat detection and blocking. |
| declarativeNetRequest | To enforce SafeSearch redirects (Google, Bing, DuckDuckGo, Yahoo) and YouTube Restricted Mode via header injection, without reading or storing any network traffic. |
| downloads | To inspect download metadata (filename, MIME type, source URL) for malware reputation checks before a file is executed. |
| storage | To store your license key, session tokens, settings, custom whitelist/blacklist entries, and local activity logs securely within your browser. |
| notifications | To display an alert notification when a malicious download is detected and cancelled. |
| Content Scripts (<all_urls>) | Statically declared scripts that run on all pages to: (1) inject the safety status bar and link safety indicators, (2) scan page text locally for scam/adult heuristics, (3) intercept form submissions and paste events locally for sensitive data pattern detection. BrowserShield does not read or transmit full webpage content unless local heuristic scanning triggers a deeper analysis. |
| host_permissions (<all_urls>) | Required to inspect URLs, inject safety indicators, and block malicious sites across all websites — regardless of which domain you visit. BrowserShield does not read or store the content of any webpage beyond what is described in Section 1B. |
The extension uses these permissions only for their intended functionality as described above.
5. Data Storage
Collected information is stored: Both locally and on secure cloud servers, depending on the data type.
Storage location: United States (Neon — PostgreSQL cloud database).
Retention periods:
- Subscription records (license key, device identifier): Retained for the duration of your active subscription. Deleted within 30 days of subscription cancellation or upon a verified deletion request.
- Support emails: Retained only as long as necessary to resolve your support inquiry. Not stored in our database.
- Logs: Local activity logs stored in your browser only (max 50 entries). Never transmitted to our servers. Cleared on extension uninstall.
- Browsing data (URLs, download metadata, and webpage text submitted for deeper analysis): Not stored. Processed in real time for threat analysis only and processed only for the duration necessary to complete the threat analysis and not intentionally retained after processing.
After the retention period expires, information is permanently deleted from our systems.
6. Data Sharing
We do not sell personal information.
We may share limited information only with service providers necessary to operate the service. Current service providers include:
- Stripe — Payment processing. Payment card details are processed directly by Stripe and are never received or stored by BrowserShield. stripe.com/privacy
- Neon — PostgreSQL cloud database hosting for license records and anonymous device identifiers.
- Vercel — Hosting for the BrowserShield web application and backend API.
- OpenAI — When a URL, suspicious webpage text, or download metadata requires deeper analysis, our backend may submit only the information necessary for threat classification to the OpenAI API (e.g., detecting phishing, scam content, or malicious files). BrowserShield does not intentionally include user account or payment information in these requests. Per OpenAI's API usage policy, data submitted via the API is not used to train OpenAI models. This processing is subject to OpenAI's Privacy Policy.
Purpose of sharing:
- Stripe: To process subscription payments securely.
- Neon: To host the database storing license keys and anonymous device identifiers.
- Vercel: To serve the web application and run the API endpoints the extension calls.
- OpenAI: To perform AI-powered classification of URLs and download metadata for real-time threat detection.
Each provider processes information only as necessary to provide its services and is bound by its own privacy and security obligations.
7. Data Security
We protect information using appropriate technical and organizational safeguards, including:
- HTTPS encryption on all communication between the extension and our backend API
- Secure session-based authentication with access controls on every API request
- Encrypted storage of database data at rest
- Device identifiers stored in encrypted database storage with access controls — the random identifier contains no personal information
- No plaintext passwords, credit card numbers, or sensitive PII stored by us
No system can guarantee absolute security, but we take reasonable measures to protect your information.
8. User Choices
You may uninstall the extension at any time via your browser's extension manager. This immediately and permanently removes all locally stored data including your settings, session tokens, whitelist, blacklist, and activity logs.
If you would also like your license record and device identifier removed from our servers, you may request deletion by contacting: hasimax.help@gmail.com. Verified deletion requests will be processed within 30 days, unless retention is required by law.
9. Children's Privacy
The extension is not intended for children under 13 years of age.
We do not knowingly collect personal information from children.
If we become aware that such information has been collected, we will delete it promptly. Please notify us at hasimax.help@gmail.com if you believe this has occurred.
10. International Data Transfers
Our database and API infrastructure are hosted in the United States. If you are accessing BrowserShield from outside the United States, please be aware that your license and device data may be transferred to and processed in the United States. We apply appropriate safeguards, including contractual protections with our service providers, to protect your information during any such transfer.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
Any updates will be posted on this page with a revised Effective Date.
Continued use of the extension after changes become effective constitutes acceptance of the updated Privacy Policy.
12. Contact Us
If you have questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact:
Hasimax / BrowserShield
Email: hasimax.help@gmail.com
Website: browsershield.hasimax.com/privacy