1. Summary

• We never collect, see or store your card numbers, bank details, passwords, names, email addresses or home addresses through the extension.
• We do not sell or share your data, show ads, or use analytics or tracking.
• Free features run locally in your browser and send nothing to us.
• Pro features send only a license key to our license server and a website hostname to public domain registries, as explained below.

2. Data Stored by the Extension

The extension stores the following in Chrome's extension storage: your settings (for example, enabled/disabled and always-warn), your trusted-merchant list, the sites where you chose "Don't ask again", and, if you activate Pro, your license key and Pro status. This data is kept in Chrome's synced extension storage, so if Chrome sync is turned on, Chrome may copy it to your other signed-in browsers through your Google account, under Google's privacy policy. The extension also keeps some data on your device only (not synced): a history of your 100 most recent checkout confirmations (each entry has the date and time, the site, whether you confirmed or cancelled, the payment method shown, and the web address of the page, without anything after a '?'), simple usage counts, free-trial end dates and renewal prices for sites where a trial was detected, and, for Pro, a 24-hour cache of domain-age lookup results. Entries saved by versions before 2.14.1 may include more of the address. When you uninstall the extension, its data is removed from your device. Data synced through your Google account is managed in your Chrome sync settings. From version 2.15.0, the extension can show a browser notification reminding you that a free trial you saw at checkout is about to end. This only happens if you choose to turn on reminder notifications, and it does not send any data to us.

3. What the Extension Reads Locally

Checkout pages: to protect you, the extension reads the visible content of pages you are viewing, such as payment buttons, the payment method shown, the amount, and subscription or free-trial terms. This happens in your browser. It never extracts card numbers, and page content is not sent anywhere. A short record of each checkout confirmation is kept on your device, as described in section 2.

WhatsApp Web (Pro): the extension reads the text and sender names of messages visible on web.whatsapp.com, in your browser only, to flag scam links and suspicious requests. Your messages are not stored or transmitted.

4. Network Requests (Pro Only)

a) License check. When you activate Pro, and when your browser starts (at most once every 24 hours), the extension sends your license key, and nothing else, to our license server (cg-license-api.vercel.app, hosted by Vercel). The server checks the key with our payment provider, Whop, to confirm your purchase. Like any web request, it exposes your IP address to the server and its hosting provider, which may keep standard request logs.

b) Domain-age check. The Pro domain-age check sends only the hostname of a website (for example, example.com) from your browser to public domain-registry (RDAP) servers, such as those of Verisign and Public Interest Registry. No page content, full URLs, form entries or payment details are sent. These requests go directly from your browser to the registries and do not pass through our servers. Registries see your IP address like any web request and handle it under their own policies.

5. Permissions

• storage: saves your settings, trusted merchants and Pro status locally.
• tabs: applies settings changes to open tabs, opens the Pro upgrade/manage pages, and lets the extension react to the page you are viewing.
• scripting and access to all sites: shows the warning overlay on checkout pages, which can be on any domain.
• RDAP registry sites: used only by the Pro domain-age check (section 4b).
• web.whatsapp.com: used only by the Pro WhatsApp Web scanner (section 3).

6. Third Parties

• Whop processes Pro purchases and verifies license keys. When you buy, Whop collects the information you give it under its own privacy policy. We do not receive your card details.
• Vercel hosts our license server.
• Public RDAP domain registries answer the Pro domain-age lookups.

We use no analytics services and show no advertising.

7. Retention

We do not keep a database of license keys or browsing data. Data on your device stays there until you delete it. Standard hosting logs may be kept by our hosting provider under its own policy.

8. Children's Privacy

ChargeGuardian is not intended for children under 13, and we do not knowingly collect information from children.

9. Your Rights

We do not sell or share personal information. If you are a California resident, or in a region with similar laws, you may ask what information relates to you or ask us to delete it. Because the extension keeps its data on your device, you can remove it yourself by uninstalling. For questions about your license, write to us at the address below. For purchase records, contact Whop.

10. Changes to This Policy

If we change this policy, we will post the new version on this page and update the "Last Updated" date. For material changes we will also say so in the extension or on our website.

11. Contact

• Email: support@chargeguardian.io
• Website: chargeguardian.io