Privacy Policy
Last updated: September 28, 2026
SurfaceWatch is a Chrome extension that checks the security settings of websites you choose. This policy explains what data it handles, where that data goes, and what we never do with it.
- SurfaceWatch has no server of its own. The extension never sends us anything. The only thing we can receive is your answer to the optional uninstall survey.
- There are no analytics, tracking or ads.
- Check results, your watchlist and your license status stay in your browser.
What the extension handles, and why
Websites you check
When you click "Check this site", when a site on your watchlist is re-checked, or when you run a bulk check, SurfaceWatch requests pages from that site to read its security headers. It also reads the content of the page you have open (for example, which scripts it loads) to find security problems. All of this happens in your browser.
Cookies
SurfaceWatch reads the names and security flags (Secure, HttpOnly, SameSite) of the checked site's cookies. It never stores or sends cookie values.
DNS lookups
To check email security (SPF and DMARC) and CAA records, SurfaceWatch sends the site's domain name to Google Public DNS (dns.google). Google's Public DNS privacy notice applies to those lookups.
Certificate logs
To list a site's publicly known subdomains, SurfaceWatch sends the domain name to crt.sh, a public Certificate Transparency search service.
SurfaceWatch Pro purchases and licenses
Pro is sold through Gumroad, which handles checkout, payments and sales tax. We never see your card or bank details. Gumroad shares your email address and order details with us so we can provide support and manage your license. Gumroad's privacy policy applies to your purchase.
When you activate Pro, the extension sends your license key to Gumroad to verify it, then re-checks it about once a day. The email address linked to your purchase, as returned by Gumroad, is saved in your browser so the settings page can show which license is active.
Optional uninstall survey
When you remove SurfaceWatch, Chrome opens a short page on our website that asks why. The page address includes only the extension's version number. Answering is optional and anonymous: we don't ask for your name or email, and the answer is stored with our website host, Netlify, only so we can improve SurfaceWatch.
Data stored on your device
Check results, your watchlist, your report branding (company name, contact line and logo) and your license status are kept in Chrome's extension storage on your device. Uninstalling the extension deletes them.
What we do not do
- We do not sell, rent or share your data.
- We do not use data for anything other than the security checks you ask for.
- We do not use data to determine creditworthiness or for lending purposes.
SurfaceWatch's use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Changes to this policy
If this policy changes, we will update the date at the top of this page. If a change affects how your data is handled, we will describe it in the extension's release notes before it takes effect.
Contact
Questions about privacy: reconvault5021@gmail.com