Browser Extension Privacy Policy

The PageScouter browser extension sends web page content to a PageScouter server. It is designed to collect and transmit as little as possible.

Which server receives your data

Everything below turns on one question, so it is answered first: the extension sends your captured pages to one server, and which server that is, is your choice.

• The hosted service (the default). The extension ships pointed at https://app.pagescouter.com, and "Log in with PageScouter" connects you to it. That server is operated by Monsolut AB, a company registered in Sweden (organisationsnummer 559303-9265, registered office in Kungsbacka), who make this extension — so on this path your captured page content and capture token are held by us, on our infrastructure, under this policy and the retention rules below. Monsolut AB is the data controller for it, and support@pagescouter.com is where to write about data held there.
• Your own server. PageScouter can be self-hosted. Open "Self-hosted, or connecting with a token" in the extension's connect screen and replace the URL with your own. Nothing then goes to us at all: the content, the token and the logs are on your machine, and whoever operates that server sets its retention and answers for its data.

There is no third option and no second destination. Whichever URL is in that box is the only place captured content and your capture token are ever sent.

Limited Use

PageScouter's use of information received from the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. The extension collects and transmits data only to provide its single purpose — web-page change monitoring — by sending the pages you choose to monitor to the PageScouter server you have connected to — ours if you use the hosted service, yours if you self-host. It is not sold or transferred to third parties, is not used for advertising, and is not used to determine creditworthiness or for lending.

What the extension stores locally

Stored in your browser via chrome.storage.local and never transmitted anywhere except to the PageScouter server you connected to:

• The PageScouter server URL you enter.
• The capture token used to authenticate to that server — whether you paste it in or obtain it through the "Log in with PageScouter" flow.
• Your background-capture and badge preferences (on/off, poll interval).
• A short summary of the most recent background poll, the hostnames you monitor (used to colour the toolbar icon), and the exact site origins approved for scheduled capture, for display and permission cleanup.
• Short-lived bookkeeping while the extension is working: the ids of any tabs a scheduled capture currently has open, and the text of the last sign-in error so the popup can show it. Both are cleared as soon as they have been used.

What the extension transmits, and to whom

The extension sends captured content and its capture token only to the PageScouter server URL you connected to — see Which server receives your data. It transmits to that server:

• The URL and the HTML source of pages you capture (manually or on schedule), so PageScouter can detect changes. The readable text is not sent separately — the server extracts it from that source.
• For each capture, a small amount of technical metadata about the fetch: the HTTP status code and a few response headers (content type, entity tag, last-modified, and the bot-protection status headers Cloudflare and AWS WAF set), used by the server's change and caching logic.
• Your capture token, to authenticate the request.

In return, the server tells the extension which of your monitors are due, which blocked pages belong to a workspace-approved site, their IDs and URLs, and a count of unread changes (shown on the toolbar badge). The extension checks Chrome's permission before moving an approved page. This is your own monitoring data, exchanged only with your server.

Scheduled background capture also makes ordinary page requests to the specific sites you chose to monitor, using your existing browser session, so those sites receive the same request data they would receive if you visited them in Chrome. The extension does not send the captured page content or capture token to those sites, Google, or any analytics/advertising service. On the hosted service, the recipient is Monsolut AB, as explained above. There is no analytics, telemetry, or tracking.

Monitoring pages behind a login

If you point a monitor at a page that requires you to be signed in, the extension captures that page using your existing browser session and sends the resulting content to your PageScouter server — so the stored content can include information visible only to your logged-in account, which may contain personal, financial, health, or private communication data depending on the page. Only capture pages whose content you are comfortable storing on your PageScouter server.

If a monitored page redirects, your browser follows it, the way it would if you had clicked the link — so the site it leads to receives an ordinary request from you. What the extension refuses to do is keep the result: if the page it ends up on belongs to a different site from the one you monitored, the content is discarded unread and the check is recorded as a failure. No other site's logged-in content is ever sent to your PageScouter server.

Ordinary server logs

Like any web service, the PageScouter server your extension talks to keeps routine operational logs of the requests it receives. Each entry typically records the source IP address, the timestamp, the HTTP method and endpoint path, the response status, and the browser user-agent string. The server additionally keeps a security audit trail (with IP address and timestamp) of account-level events such as signing in and creating or revoking a capture token.

These logs exist for operating and securing the service — debugging errors, spotting abuse — and are not used for advertising, profiling, or tracking you across sites, and are not shared with third parties. Log retention is set by whoever operates the server: us, on the hosted service; you, if you self-host.

Data retention & deletion

Captured content is retained by the PageScouter server you connected to, under that server's retention policy (by default, change history is pruned automatically over time).

Deleting a monitor in the PageScouter web app moves it to that workspace's trash, where it stays for 30 days so you can put it back. Its stored content — the current snapshot and the recorded change history — is kept for that period, and is deleted along with the monitor, permanently and including the files on disk, when the retention window ends. A workspace everybody has left is kept for 180 days and then deleted the same way, monitors and stored content included.

The server also stores the workspace's approved browser-site list and an audit record of changes to it. A workspace owner can add or remove sites under Workspace settings. When automatic browser capture is enabled, later blocked workspace pages on those sites can be moved to browser capture without another prompt, provided this browser still has Chrome's permission for that site and background checks are enabled.

Locally stored extension data is removed when you disconnect the extension or uninstall it — all of it, not a list of it: disconnecting clears the extension's local storage outright. It also stops any check already running, closes any tab that check had opened, and hands back the site access you had granted. Disconnecting also asks the server to revoke that browser's capture token. That request is best-effort: if the server cannot be reached, the local copy is still cleared but the token stays valid until you revoke it yourself under Preferences → Capture tokens, where every token can be revoked at any time.

Page content

When you capture a page, it is read by your own browser and its complete HTML source is sent to the PageScouter server you connected to. That is more than the text on the screen. A page's source routinely carries:

• hidden and pre-filled form fields, including account identifiers;
• the application state many sites embed in the page to start their interface — often JSON holding your profile, your settings, or records the page does not display;
• inline scripts, HTML comments, data- attributes, link targets, and anything the page's styling hides.

All of it is sent, because your browser is not the thing that decides what matters. What gets compared is set per monitor on the server — a comparison mode, and optionally a CSS selector — and you can change either one at any time, including long after a page was captured. The extension has no way to send only "the part that will be compared", because that part is not known when the page is read.

What is compared depends on the mode you pick:

• Text (the default) compares the readable text of the page. Attributes, hidden field values, inline scripts and HTML comments are not compared — a price that lives only in a data- attribute changes nothing in this mode.
• HTML compares the markup, attributes and hidden fields included, with <script> and <style> elements and HTML comments removed as noise.
• Text within a selector compares the readable text of the elements your selector matches.

So the source carries more than any one mode compares. It is still all sent and all kept: the server extracts text from it for display and for selector rules, and keeps the raw HTML as well — as the baseline for the next comparison, and as the before/after pair of each recorded change. The extracted text is stored in addition to the source, not instead of it. Switching a monitor to HTML mode tomorrow starts comparing markup that was captured today.

What is not read: the contents of an embedded frame (<iframe>), which is a separate document — often belonging to another site — and is left alone. Capture only pages whose full source you are comfortable storing on your PageScouter server.

Permissions

The manifest declares optional site access (*://*/*) so arbitrary user-selected sites can be supported, but the extension requests access only to the exact origins of capture monitors and sites the workspace has approved for automatic browser capture. Removing an approved site or disabling that setting lets the extension hand the unused permission back. Site access is used solely to fetch monitored pages with your existing session. The login permission (identity) is used only for the "Log in with PageScouter" handshake.

Data security

The extension requires an https:// PageScouter server URL (except localhost for development), so page content and tokens are transmitted over a secure connection. Capture tokens are revocable at any time from Preferences → Capture tokens.

Contact

Questions about this policy, or requests about data held about you, can be sent to support@pagescouter.com. That is the right address for anything held on the hosted service at app.pagescouter.com, which we operate. If you self-host, we hold none of your data and cannot reach it — the operator of that server controls what is stored on it and is the right first point of contact.