Privacy and terms
This page describes exactly what Extension Watch stores and for how long. Every line comes from the code that runs the service.
What we store
Extension Watch keeps one record for each watchlist in Workers KV, the key value store that Cloudflare provides. The record holds the watchlist name you choose, the extension IDs on the list, one snapshot for each extension (the manifest the browser would run, the access grade and the time it was checked), the change log, the full webhook URL, and a short audit log of admin actions. There is no account and no email.
When a new list starts, the service writes a trial marker for each Team trial attempt, so a single address can normally start at most 3 Team trials inside a 30 day window. The marker key holds a salted SHA-256 hash of the address, never the address itself, and the daily rate limit counters use the same salted hash. IPv4 addresses are hashed whole and IPv6 addresses are hashed by their /64 prefix. Each marker expires at the end of the 30 day window. Workers KV cannot compare and set, so the service counts markers after each write. The cap holds for claims that see each other's markers and is best effort across locations because KV is eventually consistent.
The full webhook URL is stored so alerts can be sent. The pages and API responses show it masked, as its host name only, so the secret path in the URL never appears on screen or in a shared view. Alerts contain the watchlist name and public extension data. Extension packages are read from Google and are never stored. Rules check host names with the ICANN public suffix list, which is compiled into the service instead of being fetched at run time.
The audit log records admin actions on a list, such as created, webhook set or removed, test alert sent, policy exported, a CSV download, rotate, rename and delete, with the time and the action only. Each entry is stored under its own key, so two admins acting at the same time both keep their entry. Tokens and webhook URLs are never written to it. It keeps the newest 100 entries, and the change log keeps the newest 200 entries.
How long we keep it
A watchlist record expires 90 days after the last save. A list that nobody opens for 90 days stops being checked, so it is not saved again and then expires. A list with a webhook stays checked for up to 365 days of silence, because that team reads the alerts. The read-only link that points to a list is kept for 400 days. A snapshot of an individual extension is shared between every list that watches it and expires after 3 days. Daily counters for scans, new watchlists and test alerts expire after 2 days, and trial markers for a client address expire at the end of the 30 day window. A tombstone key for a deleted list is kept for 400 days and holds only the deleted admin token and the delete time.
What we do not do
The service sets no cookies and runs no analytics. Pages load no tracking pixel and no third party script. The service does not sell data and does not send your data anywhere except the webhook you set yourself.
Subprocessors
The service runs on Cloudflare, which hosts the Worker and stores the records in Workers KV. It reads extension data from Google, from the public Chrome extension update service and from the Chrome Web Store pages. Those are the only subprocessors.
How to delete a list
Open the admin link for the list and press the delete button. That sends DELETE /api/watchlists/<admin token>. Deleting a list removes the record, its read-only link and its audit keys, so both links stop working within about a minute, the time Workers KV takes to drop cached reads. Deletion is final, with no backup copy. A small tombstone key under the old admin token is kept for 400 days so a running check re-reads it before saving, which closes the window to the time between that read and the write. It holds no list content.
Rotating the links issues a new admin link and a new read-only link, moves the list and its audit keys to the new admin link and retires the old pair. The old links stop working within about a minute, the time Workers KV takes to drop cached reads.
Never post your admin link in a public issue. If you need help, send the read-only link or ask the operator first. Use Rotate links after an admin link is shared by mistake.
Contact
Michael Lip, github.com/theluckystrike. The profile is at https://github.com/theluckystrike. Report a problem or open an issue at https://github.com/theluckystrike/extension-watch/issues.