This Privacy Policy explains how WatchPost (the "Extension") handles data. WatchPost is a security and privacy auditing tool: to do its job — flagging phishing sites, insecure cookies, missing security headers, and suspicious network activity — it necessarily looks at network requests, cookies, and page content on sites you visit. All of that analysis happens locally, inside your browser. The Extension does not run its own server and does not send your browsing data anywhere. The only exceptions are the two specific, limited cases described in §3 and §4.
1 What WatchPost sees
Because the security dashboard covers network traffic, cookies, and page content across whatever site you're on, this table is longer and more specific than a typical extension's — that's a deliberate choice over vague reassurance.
| Data | Purpose | Stored? | Transmitted? |
|---|---|---|---|
| Network request metadata (URL, method, status, timing, size, response headers) | Network log, security-header audit, tracker/exfiltration flags in the dashboard | In-memory only, in the background service worker; capped at the 500 most recent requests | No |
| Request body previews (first portion of POST/PUT bodies) | Detecting plaintext credentials sent over HTTP and possible data-exfiltration patterns | In-memory only, same 500-request cap; never written to disk | No |
| Cookies for the current page (name, value, domain, Secure/HttpOnly flags) | Cookie audit: flags cookies missing Secure/HttpOnly, overly broad domains, and known tracking cookies | Read on demand via chrome.cookies; not persisted by the Extension |
No |
| localStorage key names for the current page (not values) | Shown in the Cookie Audit tab as a quick inventory of client-side storage | Not stored | No |
| Page content signals (title, forms and their fields, links, scripts, favicon, meta tags) | Phishing heuristics: typosquat detection, brand impersonation, hidden fields, mixed content, form hijacking | Not stored | No |
| Current page URL | Only sent onward if you configure a Google Safe Browsing API key yourself (off by default) — see §4 | Not stored | Google, if configured |
| Your Safe Browsing API key (if you add one) | Authenticating your own Safe Browsing requests to Google under your own quota | chrome.storage.local |
To Google, as part of your own API requests only |
| Trial start time and PRO license status | Determining trial eligibility and unlocking PRO features | chrome.storage.local |
ExtensionPay only, for license status (see §3) |
2 Permissions used
| Permission | Justification |
|---|---|
webRequest | Read request/response metadata (URL, headers, timing, size) to build the network log and security-header analysis. WatchPost cannot and does not modify or block any request. |
host_permissions: <all_urls> | Required for webRequest and the content script to see traffic and page content on whatever site you happen to be browsing, not just one you explicitly picked — that's the core of an always-on security dashboard. This is a broad permission and Chrome's Web Store review reflects that. It also covers reading which tab/URL is active, so a separate tabs permission isn't needed on top of it. |
cookies | Read cookies for the current page's domain to run the Cookie Audit (Secure/HttpOnly flags, broad domains, known tracking cookies). |
storage | Save your optional Safe Browsing API key, trial start time, and cached PRO license status locally. |
sidePanel | Display the network log, phishing report, cookie audit, and security headers in Chrome's side panel. |
3 Payment processing (ExtensionPay)
PRO license purchases are processed by ExtensionPay (extensionpay.com), which uses Stripe for card processing. When you purchase a PRO license:
- Your email address and license status are shared with ExtensionPay so they can verify your entitlement each time the Extension checks.
- Payment card details are handled entirely by Stripe — the Extension never sees or stores them.
- ExtensionPay's own privacy policy and terms apply to the data they process.
- The Extension caches your license status locally (refreshed periodically) to avoid a network call on every action; this cache is never sent anywhere except back to ExtensionPay to refresh it.
4 Google Safe Browsing check (optional, off by default)
WatchPost can cross-check the page you're on against Google's Safe Browsing threat database. This is disabled until you turn it on: it requires you to paste your own free Google Safe Browsing API key into the Settings panel. Without a key, this check is skipped entirely and nothing is sent to Google.
- If you configure a key, the current page's URL is sent to Google's Safe Browsing API, along with your API key, to check it against known phishing/malware listings.
- No cookies, request bodies, form data, or localStorage contents are ever included in this request — only the URL.
- Google's own privacy policy governs how they handle that request. WatchPost has no visibility into or control over Google's logging of API calls made with your key.
- You can remove your key at any time from Settings, which immediately stops this check.
5 Data retention & deletion
- Network log, request body previews, DOM/phishing reports, and cookie audit data exist only in memory (in the side panel and background service worker) while your browser is running. The network log is capped at the 500 most recent requests and is discarded on browser restart, extension reload, or update — none of it is written to disk by WatchPost.
- Safe Browsing API key is stored in
chrome.storage.localuntil you clear it from Settings or uninstall the Extension. - Trial start time and PRO license cache are stored in
chrome.storage.localuntil uninstall.
To delete all stored data at any time:
- Open Settings in the side panel and click "Clear" next to the Safe Browsing key, and/or
- Right-click the Extension icon → "Manage extension" → clear storage under the Storage section, or simply uninstall the Extension.
7 Your rights (GDPR / CCPA)
WatchPost does not operate a server that stores your personal data, so there is nothing on our end to access, correct, or delete beyond what's described in §5. If you've purchased a PRO license through ExtensionPay, refer to ExtensionPay's privacy policy for rights related to that data. If you've configured a Safe Browsing key, refer to Google's privacy policy for rights related to your API usage with them.
8 Changes to this policy
If this policy changes materially — particularly anything affecting what data is collected or where it's sent — the updated version will be posted at this URL and the Extension's version number will be bumped. Continued use after changes constitutes acceptance of the new policy.
9 Contact
For privacy-specific questions about WatchPost, or to report a concern about how the Extension handles data, please reach out through the contact details provided on the Chrome Web Store listing for this Extension.