Privacy Policy

Kedayam increments three anonymous counters hosted on Cloudflare Workers when: (1) the extension is installed for the first time, (2) a page scores as dangerous and a warning is shown, or (3) a sensitive paste is intercepted. These requests carry no personal data, no URL, no device identifier, and no browsing history — only a counter name. The totals are displayed publicly on the Kedayam website as aggregate statistics.

• Browsing history
• Page contents (HTML, text, form values)
• Pasted or dropped data
• URLs you visit
• Detection results, verdicts, or scores
• Identifiers, cookies, or device fingerprints

Kedayam keeps a small amount of data in chrome.storage.local, which never leaves your browser and can be cleared any time from the extension's Options page:

• User settings (sensitivity, allowlist, theme preference)
• A bounded cache of trust verdicts keyed by hostname (TTL-bound)
• An activity log of your own recent verdicts (never page content)
• Per-domain trust counters used to learn safe sites

To stop "ClickFix" malware, Kedayam inspects text a web page writes to your clipboard to detect smuggled system commands. This check is purely in-memory and local: the page already possesses anything it copied, so nothing is exfiltrated. The clipboard text is classified and discarded — never stored, logged, or transmitted. Only a short, redacted preview appears in the warning prompt.

You can opt in to refreshing the local blocklist from free public feeds (URLhaus, Phishing Army, OpenPhish). When enabled, Kedayam downloads the public feed files only — the request carries no information about you or the pages you visit. Matching against your actual URL still happens locally. This is disabled by default and can be turned off any time in Options.

Kedayam can call Google Safe Browsing or VirusTotal only if you supply your own API key in Options. In that case, only the URL or a URL hash is sent for that lookup, and the third party's own privacy policy applies to that request. Both lookups are disabled out of the box — the default install makes zero outbound network requests.

When you paste, drop, or submit data, Kedayam runs an in-memory classifier to warn you before sensitive values leave the browser. The raw value is never persisted, logged, or transmitted, and findings are redacted before being shown to you.

A local-only debug buffer is available for development. It is off by default, held in memory only and wiped on extension restart, redacts URLs/tokens/emails before display, and is never written to storage or sent over the network.

Every permission Kedayam requests, and why, is documented in PERMISSIONS.md in the project repository.

Privacy questions can be raised by opening an issue on the project repository.