safecart-privacy

SafeCart — Privacy Policy

Last updated: 19 May 2026

SafeCart is a Chrome extension that protects online shoppers from phishing checkout pages, tracks the payments you make online so you know when an order confirmation is missing, and tells you when a store you shop at appears in a known data breach. This policy describes exactly what data SafeCart sees, where it goes, and what we never collect.

We’ve written this in plain English. Where a sentence has a footnote (¹, ², …), it points to the specific source file in the SafeCart code so you can verify the behavior yourself.

1. What data SafeCart processes

SafeCart processes the following kinds of data, only on the pages and at the moments described:

1.1 The URL of pages you visit

When you open a web page, SafeCart’s content script runs and looks at the page’s URL and DOM to see whether the page has a credit-card input field.¹ If a card field is present, the URL is scored for phishing risk.

The score is computed mostly in your browser using offline rules (HTTPS check, domain age, brand-similarity, suspicious TLDs).²
If you are signed in to a SafeCart account, the URL is sent over HTTPS to our backend, which forwards it (with our API key) to Google Safe Browsing and/or PhishTank.³ The third parties see the URL; they do not receive any identifier tied to you.
If you are NOT signed in, the URL is sent directly from your browser to Google Safe Browsing and/or PhishTank, using API keys you entered yourself.
We also send the registered domain (e.g. example.com) to https://rdap.org to check how old the domain is. RDAP is a public WHOIS lookup; no user identifier is sent.

URLs are never used for advertising, profiling, or any purpose other than scoring the page in front of you.

1.2 Pages you appear to be checking out on

When you click a “Buy” or “Pay” button on a page that has a credit-card field, SafeCart records:⁴

The merchant name (from the page’s og:site_name meta tag, page title, or hostname)
The merchant’s hostname
The order total and currency (parsed from the DOM)
The page URL and title
The timestamp of the click

This record stays in chrome.storage.local on your device. It is never sent to our servers.

If you uninstall SafeCart, this data is removed by Chrome with the extension.

1.3 Your Gmail inbox (only if you connect it)

If you choose “Connect Gmail” in Settings, SafeCart requests the https://www.googleapis.com/auth/gmail.readonly OAuth scope. With your permission, the extension reads your inbox only to look for order-confirmation emails matching a payment record.⁵ This happens:

On a timer 30 minutes after each “Buy” click, and
Manually if you ask for an immediate check.

All Gmail reads happen inside your browser, in the extension’s service worker. Email content is never transmitted to SafeCart’s servers. The match result (matched / not matched, plus the sender, subject, and date of the matching message if any) is written only to your chrome.storage.local.

You can disconnect Gmail any time in Settings; SafeCart will lose access immediately.

1.4 Domains of stores you shop at

Each store where SafeCart detects a checkout or buy click is added to a “tracked merchants” list, stored locally. Once a day, the registered domain of each tracked merchant (e.g. example.com — never a path, query string, or URL specific to you) is sent to the HaveIBeenPwned “breaches by domain” endpoint to check whether that store has had a known data breach.⁶

If you are signed in, the domain is routed through our backend so we can keep the HIBP API key on the server. The backend does not log the domain.
If you are not signed in, the domain is sent directly to HIBP from your browser.

We send only public store domains. Your email address, password, and personal identifiers are never sent to HIBP through SafeCart.

1.5 Email and password (only if you create a SafeCart account)

If you sign up for SafeCart Premium or Family, you create an account with our authentication provider, Supabase. Your email and password go from your browser directly to Supabase over HTTPS — SafeCart’s own backend never sees your password.⁷ Supabase issues a short-lived access token (JWT) which the extension uses to authenticate to our backend.

If you do not create an account, you can still use SafeCart’s free features.

1.6 Subscription details (only for paid users)

Premium and Family subscriptions are processed by Stripe. We store the following in our database (one row per paid user):⁸

Your SafeCart user ID (a UUID from Supabase)
Your Stripe customer ID and subscription ID
Your current tier (free, premium, family)
Your subscription status (active, trialing, past_due, canceled, …)
The current billing period end date
Whether cancellation at period end is scheduled

We do not store your name, billing address, card number, or any other card data. Stripe handles all card data and is PCI-DSS Level 1 compliant.

2. What SafeCart does NOT do

No advertising. We do not show ads and we do not sell or share any data with advertisers.
No analytics. SafeCart does not include Google Analytics, Mixpanel, Segment, or any third-party telemetry SDK.
No browsing history collection. We only look at the page in your current tab, only when there is a payment-form context, and we never persist a list of URLs you visited.
No keystroke logging. SafeCart does not read what you type into card-number fields. It can read the page DOM but is only interested in whether such fields exist and where they are.
No selling of data. We do not sell or rent any user data, ever. This is not a future commitment — there is no infrastructure in the product to do so.
No data shared with anyone except as described in section 3.

3. Third parties that receive data

Third party	What they see	Why
Google Safe Browsing	A URL when you reach a checkout page	Phishing/malware reputation lookup
PhishTank	A URL when you reach a checkout page	Phishing reputation lookup
RDAP (rdap.org)	A domain when you reach a checkout page	Domain-age lookup
HaveIBeenPwned	A domain (once per tracked merchant, daily)	Data-breach lookup
Google Gmail API	Inbox read queries, from your browser	Order-confirmation matching (only if you connect Gmail)
Supabase	Your email + password (signup/sign-in only); your user ID + subscription state thereafter	User accounts
Stripe	Your email and card data (only at checkout, on Stripe’s site, never via SafeCart’s UI)	Payment processing
Cloudflare	Encrypted traffic to our Workers backend	Hosting infrastructure

We do not use cookies for tracking. We do not embed third-party scripts in any UI surface.

4. Where data is stored

In your browser: settings, payment records, tracked-merchant list, breach records, Supabase session token, Stripe subscription summary. Stored in chrome.storage.local and chrome.storage.sync (the latter syncs across the Chrome installs signed into your Google account, and contains only your SafeCart identity UUID and feature toggles).
On our backend (Cloudflare Workers + Supabase Postgres): only the subscription row described in section 1.6 plus an idempotency log of Stripe webhook event IDs.
At third parties: as described in section 3.

5. How long we keep data

Local data lives for as long as the extension is installed. Uninstalling removes everything.
Subscription records on our backend are retained for the lifetime of the account, plus 90 days after cancellation for refund and tax purposes.
Stripe and Supabase retain data according to their own policies.

6. How to access or delete your data

Local data: Chrome → chrome://settings/cookies/detail?site=chrome-extension://<id> or simply uninstall the extension.
SafeCart account: email us (address below) with “Account deletion” in the subject. We delete your Supabase user, your subscription row, and your Stripe customer (Stripe retains some transaction records for tax/audit purposes; we cannot delete those).
Gmail access: revoke at https://myaccount.google.com/permissions.

We aim to action data deletion requests within 7 days.

7. Children

SafeCart is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has created a SafeCart account, contact us and we will delete it.

8. Changes to this policy

We will post any material changes to this page and update the “Last updated” date at the top. If the change broadens what data we collect or share, we will surface a notice in the extension before the change takes effect.

9. Contact

Privacy questions, deletion requests, or anything else: hewzijian06@gmail.com

Footnotes — source-code references

¹ src/content/checkout-detector.js — checkout-page detection logic. ² src/background/phishing-engine.js — scoring logic and offline heuristics. ³ workers/src/routes/proxy-safe-browsing.js, workers/src/routes/proxy-phishtank.js — proxy implementation. ⁴ src/background/payment-tracker.js — what a payment record contains. ⁵ src/background/email-checker.js — the privacy note at the top of this file describes the in-browser data flow. ⁶ src/background/breach-monitor.js — daily breach scan. ⁷ src/background/auth-client.js — sign-up and sign-in talk to Supabase directly. ⁸ workers/supabase/migrations/0001_init.sql — exact schema.