VerityRecord Chrome Extension — Privacy Policy
Last updated: July 8, 2026 · Web app privacy policy →
The extension adds the captured page to a draft evidence bag in your own VerityRecord account.
It does not seal, certify, or publish anything — sealing happens later on verityrecord.com when you review the bag.
All captured data is sent only to your account. Nothing is collected until you explicitly trigger a capture.
Data collected on capture (only when you trigger one)
| Data | Purpose | Storage | Retention |
|---|
| Active tab URL | Added as a link to your draft evidence bag | Server-side (Firestore) | Until you delete the bag |
| Active tab title | Used as the bag/file name | Server-side (Firestore) | Until you delete the bag |
| Page screenshot | Captured via captureVisibleTab() (visible viewport, or full page if you opt in) and attached to the bag | Server-side (Cloud Storage) | Until you delete the bag |
| Page HTML snapshot | Captured via chrome.scripting.executeScript() (document.documentElement.outerHTML) and attached to the bag | Server-side (Cloud Storage) | Until you delete the bag |
| OG metadata | og:image, description, favicon extracted from the page | Server-side (Firestore) | Until you delete the bag |
Data collected with user action (login)
| Data | Purpose | Storage | Retention |
|---|
| Firebase Auth token | API authentication | chrome.storage.local (managed by Chrome) | Until token expiry (≤ 1 hour) or cleared on a 401 |
| User ID (UID) | Associate captures with your account | chrome.storage.local | Until the token is cleared |
| Email address | Display in popup UI | chrome.storage.local | Until the token is cleared |
| Display name | Display in popup UI | chrome.storage.local | Until the token is cleared |
Temporary data (in-memory / session)
| Data | Purpose | Storage | Retention |
|---|
| Recently captured URLs | Duplicate detection (5-minute window) | chrome.storage.session | Until browser closes |
| Auth nonce metadata | Secure login flow | chrome.storage.session | 3 minutes max |
Page interaction (DOM preparation)
To capture full content (not truncated previews), the extension may click visible "Show more" / "View comments"
buttons in the active tab on these supported sites: Twitter/X, Instagram, LinkedIn, Facebook, Reddit, YouTube.
This happens only after you trigger a capture (toolbar click, context menu, or keyboard shortcut), only on the
active tab, and only on those specific sites. No clicks are sent to other origins. A brief auto-scroll may load
lazy content; the page is restored to its original position after capture.
What data is NOT collected?
- Browsing history — the extension does NOT track which sites you visit. It only accesses the active tab URL when you explicitly trigger a capture.
- Passwords or form data — never accessed.
- Cookies — never accessed.
- Keystrokes — never recorded.
- Data from other tabs — only the currently active tab, and only upon user action.
Local-only data (never leaves your browser)
| Data | Purpose | Storage |
|---|
| Extension settings | Capture/notification/theme preferences | chrome.storage.local |
Data transmission
- All capture data is transmitted over HTTPS to
https://verityrecord.com (the Firebase auth page may also load from https://verityrecord-31ae6.web.app). Both are first-party VerityRecord origins.
- Captured data is associated with your own account only. The extension does not send your data to any third party.
- Authentication tokens are exchanged via Chrome's secure messaging channel (
chrome.runtime.sendMessage / onMessageExternal), never via DOM or URL parameters.
- A cryptographic nonce prevents replay attacks during authentication.
Third-party services
- Firebase Authentication — Google's authentication service, used for user login. Subject to Google's Privacy Policy.
- VerityRecord — stores your captures in your account; sealing and certificate generation happen on the VerityRecord web app. Subject to the VerityRecord Privacy Policy.
User control
- Logout — clears all stored credentials from the extension immediately.
- Delete captures — delete any bag and its contents from the VerityRecord dashboard.
- Data export — request a full data export from the VerityRecord account page.
- Account deletion — removes all associated data (see data deletion).
- Uninstall — removing the extension clears all local data (
chrome.storage.local and chrome.storage.session).
Permissions explained
| Permission | Why it's needed |
|---|
activeTab | Access the current tab's URL and title when you trigger a capture |
scripting | Inject a script to capture the page's HTML/metadata and to expand truncated content (e.g. "Show more") on supported sites only |
storage | Store your extension settings and session token locally |
contextMenus | Add "Save to VerityRecord" to the right-click menu |
notifications | Show desktop notifications for keyboard / context-menu captures |
alarms | Proactively refresh the session token before it expires, and keep the service worker alive during a capture |
Contact
For privacy questions, contact: [email protected] — See also: VerityRecord Privacy Policy · Terms of Service