Eclipser Privacy Policy

Eclipser transforms the appearance of web pages on the user's device. Page content, page text, form values, passwords, browsing history, screenshots, and media pixels are not sent to the Eclipser or Huzk Ltd product/licence server. Optional account, promotion, and licence operations use a separate service only after the in-product disclosure is accepted and the user starts an action.

• Computed color, font-size, media-element type/visibility, and whether a DOM or pseudo text node is a readable candidate are processed in device memory only for immediate appearance conversion.
• The global master and 0%–80% media default; normalized-host site activation, 75%–200% text scale, global-media inheritance or a 0%–80% site media override; and site or page profiles are stored in the browser's local storage area.
• Page or form text is not stored, and canvas, image, or video pixels are not read or copied. Media dimming is applied only through CSS.
• The text and media engines run in the top document and only when every parent hop from a child frame to the top document is same-origin. Those engines do not access cross-origin embedded UI or closed Shadow DOM; the color engine can have a different scope in permitted frames.
• In system forced-colors/high-contrast mode, the color and media engines turn off; text scaling may remain active while the site is enabled. The browser-controlled Picture-in-Picture window is not changed.
• When CSSOM hides a stylesheet, the extension service worker may re-request that same stylesheet — a file your browser already loaded for that page — without cookies (credentials:"omit") and without a referrer. It only ever re-requests a URL the page itself loaded, so it contacts no server your browser has not already contacted. Cross-origin recovery is HTTPS-only, refuses loopback, private and link-local hosts, refuses any response that is not text/css, and refuses a redirect that would change the request's origin policy. The bytes are used only to compute colours on your device and are never sent anywhere. Raw CSS up to 1 MiB and the final URL can be kept in memory-only chrome.storage.session, reused for at most one hour, and retained until earlier bounded eviction or the browser/extension session ends. Page content is not sent to the product/licence service; rules from a stylesheet that stays unreadable are skipped fail-closed. A rule affecting a very large generic feed may wait until the next high-signal page change or refresh.
• To reduce repeat processing and first-paint flash, the background service worker can keep the exact web origin, up to 300 KiB of generated appearance CSS, and a dark background/foreground hint in memory-only chrome.storage.session for no more than one hour. This state is limited to 60 origins and 8 MiB in total, is unavailable to page scripts, is never written to the visited site's storage, persistent extension storage, Chrome Sync, or the product/licence server, and is ignored then removed when stale or invalid.
• Even when the user separately grants browser access to file: URLs, the site switch and site text preference are unavailable there; global media dimming can apply. Local page color profiles that can contain an absolute file path remain on that device and are not written to Google Chrome Sync.
• User information, query parameters, and fragments are removed from page profile keys.
• If Google Chrome Sync is enabled, supported settings and web profiles are written to Google's Chrome Sync area. Eclipser does not operate its own sync server.
• The automatic PDF redirection preference and optional navigation permission remain local to that device.

• Account, promotion, and Checkout requests stay disabled until the user affirmatively accepts the separate in-product disclosure. The local consent record is not included in settings export or Google Chrome Sync.
• While Checkout is pending, a versioned recovery marker remains in chrome.storage.local for at most 24 hours. Its exact data is an opaque attempt ID, an opaque customer reference, the target plan, the pre-Checkout baseline plan/status/issued timestamp, start/expiry/next-poll timestamps, and a bounded poll-attempt counter. It contains no account e-mail, Stripe Checkout URL, payment-card data, or signed licence JWT, and it stays outside settings export/import and Chrome Sync. The marker survives extension/browser-worker restarts and pending or transient results for safe recovery; it is removed after verified completion, confirmed cancellation, a handled terminal or other non-transient outcome, or expiry. Exhausting one bounded automatic-poll window pauses polling but retains the marker until explicit recovery or expiry.
• A user-started sign-in, promotion, licence, device, or billing-portal action can send the normalized e-mail address, entered one-time authentication or promotion code, a randomly generated opaque device identifier, and an optional device label. The identifier is not derived from hardware or browsing activity and is not a fingerprint.
• The licence service stores the normalized e-mail; opaque customer/device records and timestamps; optional device labels; licence and billing entitlement state; promotion creation/redemption/grant metadata; and replay-protection identifiers. Plain authentication and promotion codes are not stored in its database; bounded, domain-separated hashes are stored instead.
• The signed licence JWT contains opaque customer/device identifiers, plan/status, and validity times. It stays only in the background service worker's private IndexedDB vault (eclipser.private.v1) and is presented only for authorized licence operations. Content scripts and extension pages receive only a bounded, secret-free snapshot. The legacy eclipser.license local-storage key is migration-only and is removed only after exact durable read-back succeeds. A short recovery session stays only in chrome.storage.session. Licence, session, e-mail, and promotion data are excluded from settings export, import, and Google Chrome Sync.
• The service receives the network IP address and technical headers needed to serve and protect the request. Rate limits use short-lived counters keyed by derived hashes of the IP, e-mail, or promotion code. Application logs omit or redact full e-mail addresses, codes, JWTs, authorization headers, and service secrets. Cloudflare processes request IP addresses and technical/operational logs while hosting this service under its own terms.
• A short-lived admin session for an authorized operations role with the customers:read permission can read a bounded, keyset-paginated, minimized, and masked operational customer roster. Each roster row contains only an opaque customer ID, masked e-mail, effective plan/status, active-device count, and created/updated timestamps. The roster does not return exact e-mail, raw Stripe or payment references, client device IDs or labels, promotion records, authentication data, payment-card data, or a bulk personal-data export. Exact e-mail search and customer detail can be read only for a named support, security, or legal case after that customer creates a short-lived signed consent binding the exact purpose, case, customer, and requested field groups. The admin session, role permission, consent signature, expiry, purpose, case, fields, and current account/device generation are revalidated fail-closed on every detail request and the access is audited. An optional device label or masked device reference is visible only when the customer explicitly selects the devices field group for that case. Overview and global promotion redemption views return PII-free aggregates; promotion-code inventory remains separate.

The Eclipser view accepts only credential-free HTTPS documents and local files for which the user granted Chrome's explicit file-URL permission. HTTP and credential-bearing PDF URLs stay in the browser's original PDF flow. An accepted document loads directly from its original host and is not copied to a developer server. The source host can receive the IP address and technical headers from the normal network request.

Data is not sold, used for personalized advertising, or shared with third-party analytics services.

• Cloudflare hosts the licence Worker, D1 database, rate-limit storage, and operational security logs.
• Resend receives the requested destination e-mail address and one-time-code message only after the user requests delivery.
• Stripe Managed Payments and Link receive a server-created Checkout session only after the user selects a plan. Customers see Link as the merchant of record; Huzk Ltd is the extension publisher and product-support provider, and Google is not the seller. Stripe and Link process checkout, transaction-level support, payment, subscription, refund, and billing-portal operations. The extension and licence service do not receive or store card numbers or card security codes. Signed billing events provide the customer reference, e-mail, price/payment/subscription references, and entitlement status needed to issue or revoke access.
• For lost-response recovery, the licence service keeps the immutable URL-encoded Stripe request contract and its secret-keyed HMAC-SHA-256 for 30 days as minimized billing-operational metadata. It may contain the Checkout customer e-mail or existing Stripe customer ID, canonical return URLs, and opaque customer/attempt metadata. The full contract is excluded from admin API/UI and account-data export; only a peppered digest reaches recovery backup evidence.
• Google stores supported settings and profiles under its Chrome Sync terms when Google Chrome Sync is enabled. A selected PDF host and a stylesheet's requested or redirect-final host receive their direct requests; page content is not routed through the product/licence server.

Chrome Web Store Limited Use

Eclipser follows the Chrome Web Store User Data Policy's Limited Use requirements: data use and transfers are limited to the disclosed appearance/readability and account-entitlement features, account and entitlement operations, user-requested support, security and abuse prevention, and legal obligations. Data is not used for advertising, creditworthiness, or unrelated purposes. Human access is limited, not absent: an authorized operations role can view only the minimized, masked roster described above when necessary for those permitted operations. Exact search and customer detail require the user's explicit, specific, short-lived signed consent for a named support, security, or legal case and exact field groups; every detail read is re-authorized and audited. Aggregate views and separate promotion inventory do not expose customer details.

Settings, profiles, the local consent record, and the local licence remain in browser storage until the relevant data is removed, settings are reset where supported, or the extension is uninstalled. Disabling Google Chrome Sync removes Eclipser sync chunks; closing the browser session clears the bounded recovery session. Exact-origin CSS cache entries are eligible for reuse for no more than one hour, but an expired entry can remain ignored in memory-only chrome.storage.session until bounded eviction or the browser/extension session ends.

Authentication codes expire after 10 minutes. Rate-limit counters use one-hour windows and expire or are removed after their security window. Audited owner-console events are limited to 180 days by a daily 03:00 UTC cleanup job; submission still requires evidence that this schedule is deployed and operating in production. Device removal revokes the device but retains its opaque row for the five-device limit and abuse controls. Account, licence, promotion, billing-reference, and webhook replay records remain while needed for the service, refunds, fraud prevention, accounting, legal obligations, and disputes.

The separate deletion-journal R2 bucket stores stable opaque request/customer ids, domain-separated hashes of e-mail, provider-customer and rate-limit subjects, provider-step states/evidence hashes, and authorization/retention times solely to reapply an authorized erasure after D1 Time Travel. Daily verified cleanup deletes each checkpoint 180 days after authorization; production also requires a prefix-scoped R2 lifecycle rule for the same boundary. The operations R2 bucket stores the current recovery epoch and incident/actor/code hashes and times until superseded. Incident snapshots contain stable opaque customer/device/table-row ids, lifecycle/security state, event/reference/time fields and peppered row/identity digests. This is linkable operational data, not anonymous or “PII-free.” Open or incomplete incident snapshots have no fixed calendar expiry because blind age deletion could make safe recovery unverifiable. Safely sealed snapshot objects are deleted 180 days after closure by daily semantic cleanup. Submission stays blocked until the exceptional open-incident schedule is approved and production cleanup/lifecycle evidence exists.

The in-product account-data workflow can submit and track requests for Eclipser-controlled live records. Stripe/Link data-rights fulfillment is a separate provider process: customers can use the Stripe Privacy Portal, and Eclipser does not mark Stripe/Link deletion complete from local fulfillment alone. Cloudflare backup aging is also tracked separately from live-row erasure. A completion claim requires the local fulfillment record, the applicable Cloudflare backup-aging receipt, the Stripe Managed Payments provider notice, and the approved provider runbook evidence.

The remaining production account-record and non-admin operational-log retention periods, exact scope and verified public request channel for a full account-data export, and verified public account-deletion channel are owner-controlled inputs not configured in this draft. This policy is not ready for publication until Huzk Ltd publishes the complete schedule and working export/deletion request channels at permanent public URLs. A verified deletion request will delete or anonymize data no longer required; processors may retain legally required records.

• Access to all websites: Apply color, text-size, and media appearance changes locally to supported pages; when CSSOM hides rules, re-request without cookies only a stylesheet the page already loaded.
• Storage: Save the global master and media default, site activation/text/media preferences, and profiles and, when requested, use Google Chrome Sync; keep the bounded CSS cache in memory-only session storage.
• Alarms: Apply scheduled appearance changes at the correct boundary.
• Context menus: Offer site appearance and PDF actions.
• Optional navigation: Redirect PDF navigation to the local viewer only when automatic PDF opening is enabled.

Support page

https://eclipser.app/support

Email

[email protected]

Permanent policy

https://eclipser.app/privacy