Browser Extension Privacy Policy

Last updated: September 20, 2026

This policy describes Snyfer Shield for Microsoft Edge and Google Chrome, version 1.1.6. It covers the extension's local protection, requests to Snyfer and your controls. Visiting our website or submitting information there is covered separately by the website Privacy Policy.

Automatic protection and local data

Automatic blocking is on by default for a new installation. Protection begins when the browser installs the first verified, signed risk list. Native browser rules then block network requests to listed domains and their subdomains without sending each visited address to Snyfer. A domain missing from the list is not necessarily safe, and a listing can require correction.

Shield keeps the signed list, its verification checkpoint, update status, preferences and domain exceptions in local extension storage. The browser also stores its blocking rules. These records are not synchronized through a Snyfer account. The extension has no account system, advertising or analytics SDK.

Shield checks for list updates approximately every six hours, retries failed updates with a bounded delay and lets you request an update manually. Existing rules remain active during an outage; the interface marks a list older than 48 hours as outdated. A first installation without a verified list reports that protection is unavailable.

The alert badge is on by default and can be disabled independently. Navigation events let Shield show a local block page and identify the blocked domain. Temporary tab and timing markers are kept in memory. The local page address contains the canonical domain, without the original path or query. Showing the badge or block page does not request a score or create a browsing-history log in extension storage.

Requests that leave your device

An exception is not queried by the extension lookup. Domains absent from the local list do not trigger score requests. For extension API requests, Shield discards the original URL path and query and omits cookies and referrers. It does not send page contents, passwords or form values. Automatic network blocking itself does not require a score request.

Network requests also expose connection metadata to Snyfer and its service providers, including IP address, request time, endpoint and HTTP headers. A domain-detail endpoint includes the queried domain in its request parameters. The absence of extension analytics does not mean that network metadata is anonymous or that servers keep no logs.

Optional warning banners

Warning banners are off by default. Enabling them separately requests website access so Shield can check a page's hostname and inject a warning when appropriate. A locally matched domain may then be sent to Snyfer for details. Banners do not read page contents or form values. You can disable banners in Settings and revoke website access in the browser's extension controls. Native blocking and its local alert badge do not require this optional website access.

Providers, logs and retention

Cloudflare processes requests for network delivery and security. Snyfer's application and databases are hosted by Hetzner. These providers process connection or server data needed to deliver and protect the service. See Cloudflare's privacy policy and Hetzner's privacy policy.

The origin web server is configured to log requests, including query strings, and to rotate logs daily with 14 retained archives in addition to the active log. Application container logs rotate by size, with up to three 10 MB files. These settings describe those origin logs; they are not a promise that every provider or security record is deleted after 14 days. Provider-side retention depends on the service and applicable security and legal requirements. Contact us for questions or requests about a particular record.

The score endpoint uses IP-based request limits with one-minute counting windows. Resetting a counter does not delete an access log. In the extension, confirmed details are cached briefly in bounded service-worker memory and disappear when that worker ends. Local preferences, exceptions and the installed list remain until changed or removed with the extension.

We use extension request data to deliver protection and risk details, operate the service and prevent abuse. We do not sell it, use it for advertising or build browsing profiles from it. We do not give providers this data for their own advertising. Snyfer Shield's use of browsing information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Your controls and requests

You can turn automatic blocking or the badge off in Settings, enable or disable banners, and add or remove domain exceptions. An exception applies to the displayed registrable domain and its subdomains; adding one requires confirmation. Removing the extension removes its local data and rules according to your browser's behavior. Uninstalling does not retroactively delete server logs.

For access, correction or deletion requests about information processed by Snyfer, contact [email protected] or use our contact page. We assess requests under the applicable data-protection rules, including information that must be retained for security or legal obligations. Do not send passwords or a complete browsing history with your request.

Permissions

We update this page and its date when these practices change. Questions about this policy can be sent to [email protected].