Privacy Policy — Browser Extension

What the Extension Accesses

To filter content, the Extension reads the text and URLs of the pages you visit. This processing happens entirely on your device, in memory, at the moment a page loads, so that disallowed content can be scored and blocked before you see it. Page content, URLs, and browsing history are never sent anywhere — filtering itself is fully on-device.

Account, Subscription, and Device Pairing

Using the Extension requires signing in with a SafeSurf account (email + password). This is separate from the on-device filtering described above:

• Your email and password are sent directly to Firebase Authentication (Google infrastructure) over HTTPS to sign you in. The Extension does not operate its own authentication server and does not store your password.
• The resulting sign-in token is kept in memory only; a refresh token, your account ID, and a device ID are stored locally so you stay signed in.
• The device ID and your entitlement (subscription) status are checked against SafeSurf's backend periodically (about every 3 hours) to confirm your subscription is active. This exchanges only the device ID and status — not browsing data.

Accountability Partner ("Sponsor") Feature — Optional

If you turn this on, you choose a partner (e.g. a family member) who can be asked to approve loosening or removing protection:

• Your chosen partner's phone number and a PIN hash (not the PIN itself) are stored on your account in SafeSurf's backend and used to reach that partner for approval requests.
• Pending removal/approval requests are stored the same way and checked periodically so the Extension can react to a decision.
• This data is only shared with the partner you explicitly designate — never sold or shared with anyone else.

On-Device AI Content Classification

For image/text content detection, the Extension runs an AI model locally on your device. The first time this runs, the model weights (not code) are downloaded over HTTPS from Hugging Face's model hub and cached on your device. No page content or images are uploaded to Hugging Face or anywhere else — classification happens locally after the weights are cached.

What It Stores Locally

The Extension stores the following locally, using the browser's extension storage, never leaving your device except as described above:

• Your settings — protection on/off, filter strength, allow/block rules, and custom blocked words;
• A capped local activity log of recent filter actions, kept for your own review;
• Your cached sign-in/entitlement state (see above).

Uninstalling the Extension, or clearing it through the browser, removes this data.

What It Does Not Do

• Does not send page content, URLs, or browsing history to any server;
• Does not include analytics, tracking, or telemetry of any kind;
• Does not sell your data, or share it with third parties other than the accountability partner you explicitly choose.

Permissions and Why They Are Needed

• Access to data on the sites you visit (host access / <all_urls>): required to read page text and block disallowed content on any site. A filter limited to a fixed list of sites would not be meaningful.
• storage: to save your settings, activity log, and account/entitlement state on your device.
• tabs / webNavigation: to detect page navigations so a blocked page can be stopped before it renders.
• webRequest (Firefox only): to scan the page's network response locally before it is displayed. Responses are inspected in memory and never recorded or forwarded.
• alarms: to schedule the periodic entitlement/sponsor checks described above.
• offscreen: hosts the on-device AI content-classification models. The Manifest V3 service worker cannot run these models itself, so an offscreen document runs them locally. No content is sent off-device.
• downloads: to detect and cancel downloads that would bypass the content filter (e.g. blob: URL downloads of blocked media).
• declarativeNetRequest: to block network requests to disallowed sites and media matching your filter rules, generated entirely on-device.
• nativeMessaging: optionally communicates with a companion desktop app (installed separately by you) that enforces filtering at the OS network level. This is local inter-process communication on your device, not a network request.

Managed (Organization) Installations

When the Extension is installed by an administrator as a managed extension, the filter policy may be configured by that administrator through enterprise policy. The Extension sends no browsing data to the administrator.

Google API Limited Use Disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Changes

This privacy policy may be updated from time to time for any reason. Continued use is deemed approval of all changes.

Contact Us

If you have any questions, please contact the Service Provider at [email protected].