Privacy Policy: KeySpotter

KeySpotter warns you when a website exposes secret API keys or test-mode payment keys. It runs entirely on your own device. There is no KeySpotter account, no KeySpotter server and no backend operated by the developer. The developer does not receive, store or have any access to your data.

This policy describes, in full, what data the extension collects, how it is handled, how and where it is stored, and the circumstances in which it is shared.

KeySpotter processes one category of user data, locally on your device.

• All scanning happens locally inside your browser.
• Found keys are never transmitted, logged, or tested against any service.
• The full value of a found key is shown on screen only when you click “Reveal” in the report.
• Exports and the disclosure note always show keys masked, and web addresses in them have their query strings removed.

Website content is used for one purpose only: detecting exposed secret keys and test-mode payment keys, and showing you the result. It is not used for advertising, profiling, analytics or any other purpose.

All data stays on your device, in your browser’s extension storage.

KeySpotter shares no data with anyone. There are no analytics, no tracking and no servers.

To scan a page, KeySpotter makes these requests:

• Scripts the page loaded. They are re-requested automatically from wherever the page loaded them, which can be a content delivery network. Common library and analytics scripts are skipped. Cookies are sent only to the page’s own origin, never to other hosts. Redirects are refused, and so are private-network addresses (such as localhost) unless they are the site itself.
• Source maps are requested only when you click “Scan source maps”. They come only from the site you are viewing, only the maps that the site’s own scripts declare, and only after you grant access to that one site. Redirects are refused.
• /.well-known/security.txt is requested only when you click “Copy disclosure note”, from the site you are viewing, without cookies. Redirects are refused.

KeySpotter never requests hidden or unlinked files on any website. The page’s API responses are read from the page’s own traffic, with no extra requests.

• Scan results are deleted automatically when the tab closes.
• The script-scan cache is deleted when the browser closes.
• Alert markers expire after 30 days.
• You can clear muted sites at any time in Settings.
• Removing the extension deletes everything it stored.

KeySpotter is a developer tool. It is not directed at children and does not knowingly process children’s data.

If this policy changes, the “Last updated” date above will change, and the new policy will be published at this address before the changed extension version is released.

• I do not sell or transfer user data to third parties, outside of the approved use cases.
• I do not use or transfer user data for purposes that are unrelated to my item's single purpose.
• I do not use or transfer user data to determine creditworthiness or for lending purposes.