legal · privacy

Privacy Policy

Effective: January 1, 2026 · Plain English. No dark patterns.

Short version

TechStacker is a local-first browser extension. By default, no data leaves your machine. All captured telemetry is stored in your browser’s local IndexedDB. The extension only makes network calls when you explicitly opt in to (a) cloud vendor-definition sync with a Pro license, (b) license-key verification with Stripe, or (c) the optional webhook you configure to your own endpoint.

What the extension captures

When you visit a website, the extension listens passively to network requests and inspects the page DOM. For every page you visit, the extension records:

  • The URL of each subresource request (scripts, XHRs, fetch beacons, iframes, stylesheets)
  • The hostname of the page being visited
  • The page title
  • Whether the tab is in incognito mode (for your own per-tab configuration)
  • Timestamp of visit

This data is used solely to detect and classify third-party technologies. It is not used to fingerprint you, build a profile of you, or track your activity across sites.

What we do with that data

Nothing — by default. The data is written to your local IndexedDB and stays there. It is never transmitted off your machine.

When data does leave your machine

There are exactly three cases:

1. Cloud definition sync (Pro subscribers only)

If you enter a Pro license key in the Settings panel, the extension will periodically call app.tchstkr.com to fetch updated vendor definitions. The request contains only:

  • Your license key (to verify the subscription)
  • The current definitionsVersion on your machine (to enable delta sync)

We do not send your browsing history, your captured telemetry, your visited sites, or any personal data. The cloud response contains only the new/modified vendor pattern definitions.

2. License verification with Stripe

When you enter a license key, the extension calls our server to verify it. The server checks the key against our Stripe billing system. We receive:

  • The license key
  • An anonymous extension instance ID (random, generated on install)

3. Vendor submission (opt-in, community contributors only)

If you explicitly submit an unmapped vendor definition to the community queue, the extension sends:

  • The vendor name, category, and patterns you provided
  • The script URLs where you observed the vendor
  • Your license key (so we can credit your account if approved)

We do not send the page URL where you saw the vendor, the page title, your tab history, or any other browsing data.

4. Webhook export (you control it)

If you configure a webhook URL in Settings, the extension will POST captured telemetry to that URL after every scan. This is fully under your control. The webhook endpoint is yours — we never see the data unless your endpoint is hosted by us (it isn’t).

What we do NOT collect

  • No browsing history. Ever.
  • No form data. We don’t read form fields.
  • No cookies. We don’t read or write cookies on any site.
  • No IP addresses are stored server-side. (They appear in standard server logs, retained 30 days, then purged.)
  • No analytics on the extension itself. We don’t use Google Analytics, Mixpanel, Segment, or any third-party tracker on our properties.
  • No fingerprinting. We don’t generate or store any device fingerprint.

Host permissions

The extension declares the <all_urls> host permission because it must inspect every site you visit to detect vendors. We use this permission only to listen passively to completed requests via the chrome.webRequest API. We do not block, modify, redirect, or alter any request.

Data we store server-side

If you have a Pro license, our server stores:

  • Your email address (provided at checkout via Stripe)
  • Your license key (hashed in our database)
  • Subscription status (active, cancelled, expired) and renewal date
  • Credit balance from approved vendor submissions
  • Vendor definitions you’ve submitted (if any)

We do not store browsing data, telemetry, or visited sites on our server.

Third-party services

We use the following third-party processors:

Your rights

You can at any time:

  • Export all your local data as CSV or JSON (Settings → Export)
  • Delete all local data (Settings → Reset)
  • Request deletion of your account and all server-side data (email privacy@tchstckr.com)
  • Opt out of cloud sync while keeping your Pro license (Settings → Cloud → Disable)

We honor GDPR, CCPA, and equivalent data-subject rights.

Children’s privacy

TechStacker is not directed at children under 13. We do not knowingly collect data from children.

Changes to this policy

If we make material changes, we will:

  • Email Pro subscribers at least 30 days before the change takes effect
  • Post a banner in the extension for at least 14 days
  • Update the “Effective” date at the top of this page
  • Maintain a public diff at tchstckr.com/changelog

Contact

For any privacy question, contact:

TechStacker Privacy
privacy@tchstckr.com

For data-subject requests, please include “Data Subject Request” in the subject line. We respond within 30 days.