SecureView – Privacy Policy

Last updated: September 12, 2026  ·  Version 1.0.4
Developer: Saleem Khan  ·  https://dev.secureview.websaleem.com

SecureView is a Chrome extension that helps you understand how you spend your time online by tracking active browsing time, categorizing websites, and presenting daily summaries. This policy explains exactly what data is collected, where it is stored, what leaves your device, and what controls you have.

1. Data Collected

SecureView collects the following information while you browse:

• Domain names — the hostname of every site you visit (e.g. github.com).
• Active time — seconds spent actively browsing each domain per day.
• Page titles — the title of the active tab, used solely to improve AI categorization accuracy.
• Website category — a classification label (e.g. Technology, Social Media) assigned to each domain.
• User activity signals — mouse movement, keyboard, and scroll events are detected by a content script to distinguish active browsing from idle time. Raw event content is never recorded; only the presence of activity within a 10-second window is noted.

Browser-internal pages (e.g. chrome://, chrome-extension://, about:) are not tracked.

SecureView does not collect passwords, form input, page content, search queries, cookies, or any personally identifiable information beyond what is listed above.

2. Where Data Is Stored

All browsing data is stored locally on your device using the Chrome Storage API:

• chrome.storage.local — daily browsing records keyed by date (data_YYYY_MM_DD), settings, and the AI classification cache. This data persists until you clear it or uninstall the extension.
• chrome.storage.session — lightweight session state (current URL, active tab, window focus). This is cleared automatically when the browser is closed.

Data is partitioned by calendar day. Each day's record is independent; no cross-day aggregation is performed by the extension.

3. Data Sent Off Your Device

For websites that cannot be classified by the built-in rule set, SecureView automatically calls a cloud AI classification service to determine a category. This is the default behaviour, not an opt-in feature. The "Force AI Classification" setting extends it to every site, including ones the rule set already covers.

When a classification request is made, the following fields are sent:

• The page URL (query strings and fragments are stripped before transmission)
• The hostname
• The page title (if available)

Requests are routed through an AWS CloudFront distribution, validated by a Lambda@Edge function, forwarded to Amazon API Gateway, processed by an AWS Lambda function, and classified by Amazon Bedrock. Only the category label is returned and stored. The extension holds no API key or shared secret of any kind — the request is signed at the CloudFront edge, where the browser never sees the credential.

Classification results are cached locally under the key br_cat_cache so the same domain is never sent twice.

No browsing data is sent if: the domain is already matched by the built-in rule set and "Force AI Classification" is off, or the domain is on your exclusion list.

3a. Email Reports

Email reports are not currently active. The settings panel lets you save an email address and a delivery frequency, but those values are stored only in chrome.storage.local on your own device — nothing is transmitted, and no report is sent. If and when delivery is switched on, this policy will be updated first.

SecureView no longer has user accounts. The previous version required a sign-in to receive reports; that has been removed, and any authentication tokens left over from it are deleted from local storage when the extension updates.

4. Permissions Used

• tabs — to detect the active tab URL and title when you switch tabs or navigate.
• storage — to persist browsing data and settings locally.
• alarms — to flush accumulated time to storage every 60 seconds.
• idle — to detect when you are inactive (threshold: 60 seconds) so idle time is not counted.
• content scripts (all sites) — required to detect user activity on every page so idle time is not counted. The content script reads only the page title and the fact that activity occurred; it does not read or transmit page content.
• host_permissions — limited to the single AWS CloudFront endpoint used for AI categorization. SecureView no longer requests access to all URLs.

5. Your Controls

• Clear today's data — the 🗑 button in the popup permanently removes all browsing data for the current day.
• Exclude domains — add any domain to the Excluded Domains list in Settings. Excluded domains are never tracked or sent for classification. You can also exclude the currently active site instantly using the 🚫 button in the current-page bar; this simultaneously removes all tracking data recorded for that domain today. Tap 🔓 on an excluded site to restore tracking.
• Toggle AI categorization — disable the "Force AI Classification" setting to prevent any network requests for sites already matched by built-in rules.
• Debug logging — logging is enabled by default in beta builds and disabled in production. It can be toggled in Settings and writes only to the local browser console.
• Uninstall — removing the extension deletes all locally stored data.

6. Data Retention

Daily browsing records are automatically deleted after 7 days. The extension retains the current day plus the 6 prior days of data; older records are pruned automatically. You can also clear today's data at any time via the popup. Uninstalling the extension removes all locally stored data.

7. Third-Party Services

The AI classification pipeline runs on Amazon Web Services (AWS). AWS services involved are CloudFront, Lambda@Edge, API Gateway, Lambda, and Amazon Bedrock. AWS's own privacy practices apply to data processed through these services.

The support and uninstall-feedback forms on this website are delivered by Formspree (formspree.io). If you choose to submit one, the name, email address, topic and message you type are sent to Formspree, which forwards them to us; their own privacy practices apply. This is the only place SecureView asks for an email address, it is never taken from the extension, and nothing is sent unless you submit the form yourself. Note that uninstalling the extension opens the feedback page automatically — opening it sends nothing; only pressing submit does.

Favicon images displayed in the popup are fetched from Google's favicon service (www.google.com/s2/favicons). This exposes the domain name to Google for the purpose of retrieving an icon. No browsing time or category data is shared.

8. Children's Privacy

SecureView is not directed at children under 13. We do not knowingly collect any information from children.

9. Changes to This Policy

If this policy is updated, the revised version will be published at https://dev.secureview.websaleem.com/privacy.html with an updated date at the top of the document.

10. Contact

For questions or concerns about this privacy policy, please reach out via https://dev.secureview.websaleem.com.