Browser Extension Privacy Policy
In short
Images you send to Scanon are processed in memory for the length of the request and returned straight back to your browser. They are never written to the server's disk, and no copy is kept afterwards, anywhere. We record only the file's size and format, how many faces, number plates or screens were found, the site the upload was going to, and the credits it cost.
Text you type never leaves your browser. The extension finds personal details in what you are writing and masks them in the page itself. Nothing typed is sent to Scanon, to us, or to anyone else — not the text, not a hash of it, not a fragment.
The extension can read a site only after you have allowed that site, one site at a time. It is off everywhere until you say otherwise.
1. What the extension can read
Nothing, on any site, until you grant that site. Granting happens from the extension's own panel, from your click, one origin at a time — or as an explicit “all sites” choice you have to make deliberately. The code that watches a page is registered at runtime for the origins you have granted and no others, and a site whose access you take back is told to stop immediately, without waiting for a reload.
On a site you have allowed, it looks at exactly two things:
- Images you are uploading — the file you choose, drop or paste into that page, at the moment you attach it.
- Message boxes you type into — a multi-line composer: an email or chat body, a post, a prompt. Never a single-line field, whatever it claims to be, which rules out To/Cc/Bcc, subject lines, search boxes, login forms, passwords and one-time codes on every site at once. Fields marked by the site as a password, a one-time code or credit-card entry are excluded again by name.
It does not read the rest of the page: not the content you are looking at, not other people's messages, not your browsing history, not your cookies, not other tabs.
2. What is sent to Scanon's servers
- A downscaled copy of an image, to check it. Before anything is uploaded from a granted site, the extension makes a JPEG copy no more than 1400 pixels on its longest side and sends that to be checked. The full-size original stays in your browser.
- The original image, only if you blur it. If something is found and you choose to blur it — or you have turned on automatic blurring for that site — the original is sent so the blurred version can come back at full resolution, in the same file format. Location data in the file (EXIF, including GPS) is stripped in the process.
- Your extension key, with each of those requests, to identify the account being charged. Plus the site's domain name and the extension's version number, which are recorded with the usage (see §4).
- Your account and credit balance come back the other way, so the panel can show them.
The extension talks to api.scanon.ai and to nowhere else. It has permission to reach that one host and no other.
3. What is never sent
Anything you type. Detection runs in the page, with a fixed set of patterns shipped inside the extension — email addresses, phone numbers, card numbers, national insurance and social security numbers, bank details, keys and tokens. The part of the extension that talks to our servers is never given the text: it is told what was masked, in masked form, and nothing else. This is enforced by a test that fails the build if any file in the text path so much as imports a way to make a network request.
4. What our servers keep, and for how long
| What | Kept | For how long |
|---|---|---|
| The image itself, checked or blurred | Nothing, and it never reaches a disk. The upload streams through to the application, which decodes it in memory, works on it, and streams the result back in the same response. No file is saved, no database column holds it, not even a hash or a thumbnail. Nothing is written to the server's disk at any point: the front-end server passes image uploads straight through without spooling them, and the buffer the application uses for a body over 1 MB lives in memory, under a name that exists in no directory, and is released the moment the response is sent. | The length of one request |
| A usage record per image call | The file's size in bytes, its format, how many items were found and of which kinds (faces, plates, screens), how long it took, the credits charged, the site's domain name, the extension version, and which account and key made the call. No image content, no file name, no coordinates. | Indefinitely. It is what your usage history and rate limits are built from. |
| Your extension key | Only a SHA-256 hash of it, plus the first few characters so you can recognise it in a list. The key itself is never stored and cannot be recovered from us — if you lose it, you revoke it and make a new one. | Until you revoke the key or delete the account |
| Your account | Account identifier, plan, credit balances, and the usual billing records. | See the main Privacy Policy |
| Rate-limit counters | Per account: how many image requests were made and how many bytes they totalled, so the limits can be enforced. Numbers only — no file names, no content, nothing identifying beyond the account the requests came from. | Kept in a short rolling window and expires on its own: one minute for the request count, one hour for the byte total. |
| Text you type | Nothing. It never arrives. | — |
No copies elsewhere. Extension images are checked and blurred on the API server itself. They are never forwarded to the separate GPU machine that handles video and document work, and nothing about them is written to that machine.
Logs. The application log records, for these routes, an account identifier and the type of any error — never image content, never a file name, never the contents of a request. The access log, at both the front-end server and the application, is the standard request line — method, path, status — and never the body. A failed blur refunds the credit and writes the same usage record with zero credits charged; the image is not retained by the failure either.
No third-party processors see your images. Detection and blurring run on our own servers with our own model.
Backups. The database is backed up by daily snapshots, kept for 14 days and then expired. Images are not in them — nothing of an image reaches the database in the first place — but the account and usage rows are, so a row deleted today can still exist in a snapshot until the last snapshot that predates the deletion expires. See §8.
5. What is stored in your browser
- Your extension key and settings — which sites you have allowed, whether blurring and masking are automatic on each of them, and the last connection status. Kept in the extension's own storage, which the browser restricts to the extension's trusted pages and never exposes to any website.
- Recent blur receipts — after an automatic blur you can see exactly what was covered. These are held in session storage: memory-backed, never written to disk, and cleared when you close the browser.
- Recent masking records — what was masked in the field you are typing in, so you can undo it. These are held in memory only and disappear when the tab closes, the site is revoked, or the extension's worker restarts.
6. Permissions, and why each one is needed
| Permission | Why |
|---|---|
storage | To keep your key, your per-site settings and the last connection status in this browser. |
sidePanel | The extension's entire interface is the side panel. |
activeTab | To read the address of the tab you are on after you click the extension's icon, so the panel can name the site it is offering to work on. It grants nothing until you invoke the extension, and nothing that persists. |
contextMenus | The “turn Scanon on/off for this site” item on the icon's right-click menu. Left-click has to open the panel, so the menu is the only place on the icon for a switch. |
scripting | To load the part that watches uploads and message boxes into the sites you have granted, and only those. The alternative — declaring the sites in the extension's manifest — would mean naming every site in advance and asking for access to all of them at install. |
Access to api.scanon.ai | The only website access granted when you install: how the extension reaches Scanon. |
| Optional: access to a website | Asked for one site at a time, from your click in the panel, at the moment you want Scanon to work there. “Enable on all sites” is the same permission asked for broadly, and is always something you choose deliberately. Removable from the same panel at any time. |
Optional: tabs | Lets the panel keep up as you switch tabs without a click each time. Your browser describes this as reading your browsing history; it is never granted at install, it is offered from a button that says exactly that, and it can be removed on its own line in the panel. The extension uses it only to know which site the current tab is on. |
7. What we do not do
- We do not sell your data, and we do not share it with anyone for advertising.
- There is no advertising in the extension.
- There is no analytics or tracking code in the extension. It makes no network request to anywhere but
api.scanon.ai, and only to check an image, blur one, or read your account. There is no telemetry, no crash reporting and no third-party SDK inside it.
For completeness: this website uses Google Analytics and Vercel Analytics, as described in the main Privacy Policy. That is the website, not the extension — the extension carries neither.
8. Deleting your data
- Remove the key — in the extension's settings, Remove key. The extension stops checking anything immediately, and the key is gone from this browser.
- Revoke the key — on your account page, under Browser Extension. It stops working everywhere you have pasted it, at once.
- Uninstall the extension — the browser deletes everything it stored: the key, the settings, the receipts.
- Delete your account — from your account page. Your identifying details are erased and the account can no longer be used, which also stops any extension key that belongs to it. Usage records (sizes, counts, dates, site domains) survive in anonymised form, attached to an account that no longer names anyone; a limited billing archive is retained for fraud and payment disputes. This is described in full in the main Privacy Policy.
Backups take up to 14 days to catch up. Whichever of these you do, the change takes effect in the live system at once — the key stops working, the settings go, the account can no longer be used. Daily database snapshots are kept for 14 days, so rows that were deleted or scrubbed can still exist in a snapshot for up to that long before it expires. Snapshots are used only to restore the service after a failure, never to look anything up.
9. Contact
Scanon.ai Systems Inc. — info@scanon.ai. For privacy requests, put “Privacy Request” in the subject line.
If this policy changes, the date at the top changes with it. This page is the privacy policy given for the Scanon extension on the Chrome Web Store and Microsoft Edge Add-ons.