Privacy Policy

URLCheck is a browser extension that shows you the destination URL in a large, readable on-screen bubble as you navigate the web. This policy explains exactly what information we collect, what we do not collect, and how we protect what little we do hold.

We do not record, store, sell, or share any browsing data. We never see which websites you visit, which links you click, or any part of your browsing or URL history, and we never access your page contents, passwords, or financial information. The entire point of the extension is to show youthe URL; it is never sent to our servers, and it is never used for advertising, tracking, profiling, or resale.

What we collect

• Email address. You provide this when you sign in to start your free trial. We use it to identify your account, send transactional emails (magic-link sign-ins, billing receipts), and (only if you opt in) product updates.
• Subscription state. We record whether your account is in a free trial, has an active paid subscription, or has no active subscription. We also store the trial start and end dates and, for paid subscribers, the current billing-period end date (provided by Stripe).

What we do not collect

• Browsing data or history. The extension reads the URL currently in your address bar so it can display it to you. That URL is never sent to us. We have no record of any site you have ever visited.
• Passwords, financial data, or page contents. URLCheckdisplays the web address only. It is not designed to read your passwords, your financial information, or the content of the pages you visit.
• Private and incognito browsing. The extension is disabled in private/incognito windows by default and does not operate in those sessions.
• Payment card data. All payment processing is handled directly by Stripe. We never see, store, or transmit your card number, CVV, or any other card detail. Stripe's privacy policy governs how they handle payment data.
• Device identifiers or fingerprints. We do not fingerprint your device. Your subscription is associated with your account (email) and can be used on all your devices.
• Personal analytics data. If analytics are enabled on this marketing website, they are collected in an aggregated, anonymous form (no personal data, no unique identifiers). No non-essential cookies are set by default.

• To authenticate you when you sign in (we email you a magic link, no password required).
• To determine whether your account is entitled to use the extension (trial or active subscription).
• To process your subscription and send billing receipts, via Stripe.
• To send transactional emails related to your account (e.g., trial expiry reminders, subscription confirmation).

We do not sell your personal information. We do not use your email address for advertising. We do not share your information with third parties except as needed to operate the service (Stripe for payments, a transactional email provider for sign-in links and receipts) or as required by law.

The extension itself sets no cookies. This marketing website does not set non-essential cookies by default. If privacy-friendly analytics are enabled (using a tool like Plausible), they collect only aggregated, anonymous traffic statistics: no personal data, no tracking across sites, no advertising profiles.

Strictly necessary cookies may be set by the backend authentication flow (e.g., a session state during the magic-link sign-in). These are deleted when their purpose is complete.

We retain your account data (email and subscription state) for as long as your account exists. When you delete your account, all personal data we hold is deleted within 30 days, except where we are required by law to retain certain records (for example, billing records for tax purposes, which are retained for the legally required period).

Depending on where you live, you may have rights to access, correct, or delete your personal data, or to request a copy of it in a portable format.

Account deletion: You can delete your account and all associated personal data at any time from within the extension's settings. Deletion takes effect immediately; your data is purged within 30 days.

To exercise any other privacy rights, contact us at support@urlcheck.app. We will respond within 30 days.

Sign-in uses single-use magic links over TLS. Entitlement tokens are cryptographically signed (RS256) and expire after seven days. Refresh tokens are stored hashed and rotate on each use. We apply industry-standard security practices, but no system is perfectly secure. Please contact us immediately if you believe your account has been compromised.

URLCheck is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We will post any material changes to this policy on this page and update the “last updated” date. If changes are significant, we will notify you by email. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

Questions about this privacy policy? support@urlcheck.app