Privacy Policy

TrackerScout browser extension · last updated 2026-08-21

TrackerScout is a browser extension that improves how pages of discussion boards and trackers you already visit are displayed. This policy describes every piece of data it touches, where that data stays, and what reaches our server.

1. What stays in your browser and never leaves it

Browsing history. The extension asks Chrome's history API which topic pages of the connected site you have already opened, so it can dim them and offer to open the rest. The query is limited to the site you are looking at. The result is used on the page and discarded — it is never stored by the extension and never sent anywhere.
Your settings — which features are on, filter words, button positions, theme and language. Stored with chrome.storage. If you are signed into Chrome, Chrome itself may sync them across your devices; that is Chrome's sync, not ours.
The list of sites you connected and the section tree read from each of them. Stored locally with chrome.storage.local.
Page contents. The extension reads the pages of connected sites in order to change how they look. Nothing read from a page is transmitted, logged or retained.

The extension has no analytics, no advertising, no tracking pixels and no third-party scripts of any kind.

2. What is sent to our server

Three things reach our server (trackerscout-api.henzoteam.workers.dev): the paid Pro subscription, the invite code on the extension's "Pro" tab, and the support form on the "Support" tab. Nothing else does — if you buy nothing, invite nobody and write nothing, the extension makes no requests to us at all.

When you activate or renew a subscription we receive and store:

A hash of your email address. Your address is hashed (SHA-256) and only the hash is stored; the plain address is never written to our database.
A device identifier generated by the extension, plus the time it was first seen and last seen. It exists to cap how many devices one subscription unlocks.
Subscription state — status, expiry date and the contract identifier issued by our payment provider.
An activation record: the email hash, the device identifier, a salted hash of your IP address, the two-letter country your request came from, the extension version, the outcome and a timestamp. Its only purpose is to notice a subscription key that has been published publicly. A salted hash of an IP address is a pseudonym, not anonymity — we state that plainly rather than claim more.
Self-check reports. If the extension detects that its own licence check has been tampered with, it reports the reason together with the same fields as above.
Payment events delivered by our payment provider, lava.top, so that a paid subscription becomes active.

When you press "Send" on the support form, and only then, we receive:

Your message and the contact you typed in — that is what you are asking us to deliver — together with the interface language.
The device identifier described above. It is what limits how many messages one device can send per day, so it travels with every submission; the counter stores a salted hash of it, never the identifier itself.
Extension version, browser user-agent string and whether the subscription is active — only while the "attach diagnostics" box is ticked. Untick it and these are not put in the request at all.

The message is not written to our database. It is forwarded to a Telegram bot chat, which is where it is read and kept — see section 4.

When you ask for an invite code, or enter someone else's, we receive:

A hash of the email address the code belongs to. As with a subscription, the address is hashed (SHA-256) before anything is written; the plain address is never stored.
The code itself and the fact that it was redeemed, so that one code cannot be used more times than the reward allows.
The device identifier described above, when a code is redeemed, because the reward unlocks the extension on a device.

No message is sent to the person you invite, and we have no way to send one: we hold no address to send it to. The code is a string you pass on yourself, by whatever means you choose.

3. What we never do

We do not sell or transfer your data to third parties.
We do not use or transfer it for advertising, credit scoring or lending.
We do not use it for any purpose unrelated to the extension's single purpose and the features described in the store listing.
We do not build profiles of what you read, download or search for.

This is the Limited Use commitment required by the Chrome Web Store User Data Policy, and it applies in full.

4. Who else is involved

Cloudflare hosts the licence backend (Workers and D1) and processes requests on our behalf.
lava.top is the payment provider. Payment details are entered on their site and never pass through the extension or our server; we receive only the event that a subscription was paid, cancelled or failed.
Telegram delivers support messages. A message you send through the form is stored in Telegram's chat under Telegram's own rules, not ours.

5. How long we keep it

Activation records are deleted automatically after 90 days.
Subscription and device records are kept while the subscription exists. Removing a device deletes its record immediately.
Self-check reports are kept while they remain useful for spotting abuse.
Invite codes and the record that a code was redeemed are kept while the code exists, because that record is the only thing stopping one code from being spent twice.
Support messages live in the developer's Telegram chat; our database holds no copy. Delete a message on your side and the copy in the chat still stands — write to us and we will delete it there.
Rate-limit counters hold salted hashes of an address and of a device identifier, and are overwritten by the next time window — an hour for the address, a day for the device.
Cloudflare keeps its own technical request logs on our behalf, under its own retention rules.

6. Your choices

Uninstalling the extension removes everything stored in your browser.
Disconnecting a site in the settings revokes our access to it and removes its scripts.
Write to thenolandiam@gmail.com to have your subscription data deleted. Because we store only a hash of your address, quote the address you paid with so we can find the record.

7. If you are in the European Economic Area or the UK

The controller of the data described in section 2 is Sergey Baltutin, reachable at thenolandiam@gmail.com. If you use the free plan, no personal data reaches us at all, and this section has nothing to apply to.

Why we may process it. The email hash, the device records and the subscription state are needed to give you what you paid for (performance of a contract). The activation records and self-check reports exist for our legitimate interest in noticing subscription keys that were published publicly.
Your rights. Access, rectification, erasure, restriction, objection and portability. Write to thenolandiam@gmail.com from the address you paid with — we store only its hash, so without it we cannot find your record.
Complaints. You may complain to the data protection authority of the country you live in.
Where it is processed. On Cloudflare's infrastructure, which may process it outside the EEA under the safeguards Cloudflare provides for such transfers.
No automated decisions. Nothing here profiles you or decides anything about you automatically, beyond blocking a subscription key that is being shared publicly.

8. Children

The extension is not directed at children and we do not knowingly collect data from them.

9. Changes

If this policy changes, the date at the top changes with it. Material changes will be noted in the extension's release notes.

10. Contact

Sergey Baltutin · thenolandiam@gmail.com