Privacy Policy

What the extension stores (locally only)

Evidence bundles (redirect hops, click IDs, timestamps, session-continuity events, order number/total, a locally redacted screenshot, SHA-256 hashes), portal snapshots for decline monitoring, when each portal was last checked, whether that check succeeded and, if it failed, the reason it gave (at most 200 characters, which can quote text from your own portal activity page), which locale of a multi-domain portal you use (inferred from your own portal visits and click-outs, so the monitor checks the site you actually log into), settings, and — on Pro — the license key with its signed validation certificate. It also keeps a short problems log — up to 200 entries of a time, a component, an error code and at most a host name (never a full address, cookie value or page content) — so failures are recorded and shown in the vault's Recent problems list instead of being hidden. It also keeps a list of affiliate networks: the ones you approved, the ones whose access was removed, the ones it saw in your click trails and the ones you told it never to ask about. About them it keeps site names and dates only, never full addresses: the portals a network was seen from and the sites next to it on its first trip, when it was first and last seen, how many trips passed through it and whether every hop through it was visible, the site access granted for it, when it was approved, removed or blocked, and whether it was already announced to you. A network it only saw is kept for 30 days after its last sighting, at most 50 of them, then dropped together with its announcement mark. Otherwise the announcement mark stays until you forget the network or erase everything — also after you undo a Never, which leaves nothing else stored about that network. When a purchase recording ends without evidence (the tab was closed or replaced, or the browser restarted), it keeps a trip record for 30 days (at most 20): the portal, the store's origin, the times, why it ended, the click ID, the click-trail addresses of the portal, network, any other site the click passed through, and store-landing hops, and the gaps it noticed. Trips are never used to flag a purchase as untracked; you can save one as evidence, and erasing everything removes them. While a purchase is being recorded, a one-line note (portal, store origin, times, click ID and how far the recording got) is written so a browser restart can tell you what was interrupted; it is removed when the recording ends. It keeps a record of the site access it holds or sees granted: for each site, whether it was allowed for a purchase, for an affiliate network you approved, or in Chrome's extension settings, since when, and which purchase recordings use it; and which of its built-in sites (the four portals and the networks it ships) Chrome is currently blocking or allowing on https pages only. It keeps short site-access notices, each naming a site: that Chrome is blocking one of its built-in sites or allowing it on https pages only, or that access to a network you approved was removed. A notice goes away when that access comes back; erasing everything clears them, and one that is still true comes back right after. While you browse a portal, it keeps in the browser's session storage (emptied when the browser closes) which open tabs show a portal, and the addresses of the portal pages each tab showed in the last few seconds — at most 12 per tab, each dropped about 8 seconds after it loaded, except the page the tab is still showing — so a click-out can be matched to the page you clicked on.

All of it lives in the browser's local storage on the device. There is no cloud copy, no sync, no account, and no telemetry of any kind.

What the extension observes (locally, never transmitted)

On the four portal sites, the extension notes the time of each click you make — not what you clicked or where it pointed — so it can tell a cashback click-out from an address you typed. When you leave the portal right after a click, it follows the navigation to the store and records the full address of every page the tab passes through between the portal and the store, and of every redirect Chrome reports along the way — portal and affiliate-network hops, any other site the click passes through, and the store page you land on, including the click ID and other query text they carry — plus the store's origin. These addresses are kept in the evidence bundle. On the store it records only same-store page addresses while the purchase is live; of other sites you visit it keeps at most the origin of a site you leave the store for, and the address of an affiliate-network or portal redirect that interrupts the purchase. Timings and hops stay on the device.

During a purchase you started from a supported portal, the extension watches the affiliate tracking cookies on the portal's affiliate networks and on networks you approved — and, if you enable auto-capture, on the retailer — to detect when a coupon extension, ad-blocker, or other party overwrites or clears the cookie carrying your cashback attribution. This is read-only: the extension never sets or removes a cookie, and the cookie's value is never stored or transmitted. The only things it records are the network name, the cookie name, a timestamp, and whether the cookie matched your own click. Reading happens entirely on your device; nothing about it goes over the network, and it adds no new network destinations — the complete network surface below is unchanged. You can turn the attribution radar off in the vault's settings; when it is off, nothing is read from the retailer, and nothing is recorded, classified, or acted on.

The optional conflicting-extension scan runs only when you click "Scan for conflicting extensions" in the vault's settings. It reads the installed-extension list Chrome reports (each extension's name, id and on/off state) once, on this device, keeps only the matches against a list of known coupon and cashback extensions bundled with the extension, and drops the permission it asked for right after. Nothing about it goes over the network. Erasing everything in the vault also clears the stored result.

The complete network surface

1. 01

   Your portal pages — the extension reads cashback activity pages on the four supported portals using your own logged-in browser session. No credentials are collected or stored.

2. 02

   license.cashbackproof.com (Pro only) — about once a week the extension sends your license key and its activation instance id to validate the subscription with the payment provider. The license server is stateless: it stores no records of any kind. If it is unreachable, Pro keeps working for 14 days (fail-open; it retries about daily while it is unreachable) — outages never lock your data.

3. 03

   OpenTimestamps calendars (Pro, opt-in, OFF by default) — if you enable timestamp anchoring, the extension sends the 64-character SHA-256 fingerprint of a new evidence bundle to an OpenTimestamps calendar (a.pool.opentimestamps.org or b.pool.opentimestamps.org). The fingerprint reveals nothing about the bundle's contents; it lets you prove later that the evidence existed by that date.

Nothing else. No analytics, no error reporting, no content servers.

Payments

Pro is sold by Lemon Squeezy as merchant of record; payment details never touch Cashbackproof. The license key Lemon Squeezy issues is the only purchase artifact the extension ever sees.

Your controls

Export everything as JSON, erase everything, deactivate the license on a device, and toggle every feature — all from the vault's settings. "Erase everything" wipes evidence, removes the site access you allowed through Cashbackproof for your purchases and for the affiliate networks you approved (site access you granted in Chrome's extension settings stays), forgets every network it has seen, approved or been told never to ask about (and those whose access was removed), deletes the trip records and the live-recording note, and clears its notices and the problems log (a site-access notice that is still true comes back right after). It keeps the license (it isn't evidence), your settings, each portal's last-check status (including the reason a failed check gave), which locale of each portal you use, an internal version stamp and, until the browser closes, which open tabs show a portal. Uninstalling the extension deletes all local data.