LEGAL

Browser Extension Privacy Policy

This policy explains what the NicheObserver browser extension reads, sends and stores when it displays automatic website profiles.

Effective and last updated: September 7, 2026

1. Who is responsible

2. When the extension starts processing

The extension does not read website signals or send a hostname until you choose Enable automatic profiles in its first-use screen. Once enabled, it automatically analyses each public HTTP or HTTPS website you visit so that its toolbar badge and popup stay current. It does not run in Incognito mode.

You can withdraw this choice at any time by selecting Turn off in the extension popup. Turning it off stops automatic analysis, clears the extension's session data and resets its toolbar badges.

3. Data processed on your device

For its user-facing website profile, the extension reads:

• the hostname of the current public website, such as shop.example.com;
• bounded technical signals visible to the browser, including generator metadata, DOM markers and public resource locations, to identify supported website platforms and advertising pixels;
• the browser's light or dark colour preference, solely to render the extension icon.

Technology and advertising-pixel detection happens locally in Chrome. The detected technologies, DOM markers, resource locations and colour preference are not sent to NicheObserver.

4. Data sent to NicheObserver

After activation, the extension sends the normalized hostname in the JSON body of an HTTPS POST request to https://api.nicheobserver.com to retrieve the matching public Chrome UX Report profile. The hostname is not placed in the request URL or query string. The request necessarily includes ordinary network metadata, such as the IP address and HTTP headers, while it is routed and protected.

Profile requests do not send the page path, query parameters, URL fragment, page title, page text, form contents, cookies, account credentials or the locally detected technologies and pixels. The extension does not send a Chrome browsing-history export or a list of previously visited websites.

Optional account connection

You can connect the extension to your free NicheObserver account. Sign-in takes place on https://nicheobserver.com, using the existing email or Google login. Confirm the matching code on the website to connect this browser. The extension does not receive your password, email address or Google credentials.

Account requests go separately to https://nicheobserver.com/auth/extension over HTTPS. The extension receives credentials limited to its Reach badge. Public profile requests never include these credentials or account identifiers; the connection is not used to attach the websites you visit to your account. Connecting an account does not enable automatic profiles or add analytics events.

5. Storage and retention

• Consent preference: Chrome local storage keeps the consent version and activation time until you turn automatic profiles off, clear the extension's storage or uninstall it.
• Active dates: local storage keeps up to eight UTC dates on which the anonymous badge was used, without visited websites. These dates support the badge's trial policy, are not sent to our servers and can be removed by clearing extension storage or uninstalling. Turning off profiles does not erase these dates.
• Account connection: credentials are stored encrypted with AES-GCM in local browser storage, with a non-exportable encryption key in the extension's IndexedDB. Access credentials expire after one hour and are renewed while the connection remains valid, for at most 30 days before another sign-in. The server stores credential hashes and their account association to verify and revoke badge access, not the plaintext credentials. Expired authorizations are no longer usable and are removed during subsequent authorization cleanup.
• Tab state and CrUX profiles: Chrome session storage keeps the current tab results and profile cache only for the active browser session. API responses are marked private and not stored by shared HTTP caches. Chrome clears the extension's session memory when the browser session ends, the extension is disabled, reloaded, updated or uninstalled. Turning automatic profiles off clears it immediately.
• NicheObserver systems: the hostname is processed to return the requested public profile. Access logs for profile requests record the route, status, timing, client IP address and browser headers for security and service diagnostics, not the lookup hostname, request body or query string. Authorization logs do not record codes, credentials or request bodies. This information is not used to build a browsing profile.
• Security controls: transient in-memory rate-limit information may be processed to protect the API from abuse. It is not used to build a browsing profile.

6. Why the data is processed

The hostname and local technical signals are processed with your consent to provide the automatic toolbar badge and website profile you enabled. Minimal network information is processed where necessary to deliver the service and for Overdrive Assets' legitimate interests in securing the API, preventing abuse and measuring aggregate reliability.

NicheObserver does not use extension data for personalized advertising, credit decisions, unrelated profiling or generalized market research. It does not sell extension data.

7. Service providers and disclosures

Request data is handled only by Overdrive Assets and providers necessary to operate the extension:

• Cloudflare, Inc. routes and protects API traffic and may process the hostname, IP address and network/security metadata under its privacy policy.
• Hetzner Online GmbH provides the server infrastructure used to answer API requests in Germany under its privacy policy.

The hostname is not forwarded to Google for each lookup: NicheObserver answers from its own local copy of public Chrome UX Report data. Data may be disclosed where required by law or where strictly necessary to investigate security abuse. Human access is not permitted except for those purposes or when you explicitly request support involving specific data.

8. International processing

Overdrive Assets is established in Mauritius, the API infrastructure is hosted in Germany, and Cloudflare operates a global network. Network data may therefore be processed outside your country. Overdrive Assets limits processing and provider access to what is necessary for the purposes described in this policy.

9. Your choices and rights

You can stop processing and clear session data through Turn off in the popup. You may also clear extension storage or uninstall the extension through Chrome.

Use Sign out in the extension's account screen to revoke this browser's connection and remove its locally stored credentials. Turning off profiles or signing out of the website does not disconnect the extension. Uninstalling removes extension storage but does not delete your NicheObserver account; contact [email protected] for account deletion.

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, or withdraw consent. Email [email protected]. You may also complain to the Mauritius Data Protection Office or the data-protection authority in your country.

10. Chrome Web Store Limited Use

NicheObserver's use of information received from Chrome extension APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide or improve the extension's disclosed, user-facing purpose.

11. Changes and contact

If the extension's data practices materially change, users will be informed in the extension before the new processing begins and a new consent version will be requested where necessary. The effective date above will also be updated.

Questions about this policy can be sent to [email protected].