Curbray privacy policy
Effective 2026-10-18 · applies to the Curbray Chrome extension, version 0.1.0 and later · publisher: Gilad Amar ("we")
1. Data the extension handles on your device
| Data | Where it is kept | How long |
|---|---|---|
| Scan history: page address and title, the issues found, and the failing elements' selectors and HTML snippets (Free: 3 scans, Pro: 30) | chrome.storage.local | Until you clear history in Settings, or uninstall |
| Settings: default standard, theme, report branding (name, contact line, colour, logo image you upload) | chrome.storage.local | Until you change them or uninstall |
| Reports and CSV exports | Your browser's print dialog / PDF, or a file in Downloads | Under your control |
| License details if you activate Pro: the key, Lemon Squeezy activation ID, plan, the purchase email and expiry returned by Lemon Squeezy, and the last check time | chrome.storage.local | Until you deactivate the license or uninstall |
None of this data is sent to us; we do not operate any server that receives it.
2. Data that leaves your device
Site audits (Pro). For a site audit, Curbray opens the pages you listed (on the same site) one by one in a background tab, as if you visited them, scans each and closes the tab. It skips logout and admin links.
License checks. If you enter a Pro license key, the extension sends HTTPS requests to https://api.lemonsqueezy.com/v1/licenses/: activate (your key and a random instance name), validate (your key and the activation ID, at most once every 7 days, triggered by a once-a-day background check) and deactivate (when you click Deactivate). Lemon Squeezy (Merchant of Record) receives your IP address as with any web request and processes this data under its privacy policy. Checkout happens on Lemon Squeezy's website, not in the extension.
3. Access to websites
- Site access (
<all_urls>) is an optional permission, requested for one site at a time when you press Scan on it. Nothing is granted at install. You can remove access in Chrome's extension settings. - The bundled axe-core engine (© Deque Systems, MPL-2.0) is injected only into the page you scan. It is part of the package, not loaded from the internet.
- No remote code is loaded. All code ships inside the extension package (Content Security Policy
script-src 'self').
4. Permissions and why we need them
| Permission | Used for |
|---|---|
storage | Settings, scan history and license status on your device |
sidePanel | Showing Curbray next to the page |
scripting | Running the accessibility rules in the page you scan, and outlining an element |
activeTab | Reading the current tab's address when you open Curbray |
alarms | The once-a-day check of whether a Pro license is due for its weekly re-validation |
Optional site access (<all_urls>, granted per site) | Working on the sites you choose (section 3) |
Host access to api.lemonsqueezy.com | License activation, validation and deactivation (section 2) |
5. What we don't do
- No analytics, telemetry, advertising, cookies or fingerprinting in the extension.
- We don't sell or transfer user data to third parties, except the license check described above.
- We don't use or transfer user data for purposes unrelated to the extension's single purpose.
- We don't use or transfer user data to determine creditworthiness or for lending purposes.
The use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.
6. Your choices and rights
Clear scan history in Settings, remove the logo, deactivate your license, or uninstall Curbray. Uninstalling Curbray removes all of its storage. We hold no extension data on our servers. For purchase records held by Lemon Squeezy or any privacy question (including GDPR/UK GDPR requests), email busywright@mail.grokbot.com.
7. Children
Curbray is a workplace tool and is not directed at children under 16.
8. Changes
If a future version handles data differently, we will update this page and the effective date before releasing it.
9. Contact
Gilad Amar, Thailand · busywright@mail.grokbot.com