Summary
- Extension files you select are read locally in your browser. They are not uploaded to us.
- Reports are generated in the page and are not stored on a server.
- There are no accounts, advertising scripts or third-party analytics on this site.
- If you submit a store URL, our server fetches the public package from the official store and returns it to your browser. That request may appear in short-lived server or hosting logs.
Files you upload
When you choose a CRX, XPI, ZIP or manifest.json file, the file is read by JavaScript in your browser. Parsing and static analysis run in a Web Worker. The extension code is treated as data and is never executed. The file never leaves your device through this website.
Reports and exports (JSON or PDF) are created in your browser. Closing or reloading the page removes them. We cannot access, restore or delete a report because we never receive it.
Store URL requests
The optional store feature sends the URL you paste to our server endpoint. The server checks that the URL belongs to an official Chrome Web Store, Microsoft Edge Add-ons or Firefox Add-ons host, downloads the public package, and returns it to your browser for local analysis. We do not keep a copy of the package or the resulting report. Standard technical logs from our hosting provider may record the request time, IP address, requested URL and response status for security and rate limiting. These logs are retained only as long as necessary for those purposes.
Store fetching is rate limited. We may block abusive requests. If a store blocks automated retrieval, you can download the package yourself and upload it directly.
Cookies and local storage
We set a single cookie, epc_locale, to remember your interface language. It contains a language code and expires after one year. We do not use advertising cookies, cross-site tracking pixels or third-party analytics. Your browser may store normal technical data such as cached assets.
Server logs and security
Like most websites, our hosting provider processes standard request data to deliver pages and protect the service. Security headers are applied to pages and API responses. We do not sell personal data and we do not build user profiles.
Children
The tool is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children.
Your choices
You can avoid all server contact by uploading a package file instead of using a store URL. You can clear the locale cookie in your browser settings at any time. Because we do not hold reports, there is no stored analysis to request or delete.
Changes
If this policy changes, the updated date at the top of this page will change. Material changes will be reflected in the published text of this policy.
Contact
Questions about this policy can be sent to ihsannaslam@gmail.com.