Privacy Policy

1. The Fundamental Privacy Invariant: Zero Data Egress

The KnowThankYew Reality Engine is an open-source consumer advocacy extension designed to detect subscription traps, mandatory arbitration waivers, unilateral modification clauses, and dark patterns in digital agreements.

All statutory analysis, regular expression matching, and risk evaluation occur 100% locally on your device silicon within your browser's execution sandbox.

2. Technical Enforcement & Browser Security Model

Our zero-egress architecture is enforced not through policy promises, but through hard technical boundaries:

• Browser-Enforced Content Security Policy (CSP): The extension declares connect-src 'none' in its Manifest V3 configuration. The Chromium browser engine physically intercepts and drops any outgoing network request (such as fetch(), XMLHttpRequest, or WebSocket) initiated from extension contexts.
• Zero Remote Host Permissions: The extension requests no broad host permissions (<all_urls> is strictly absent). It cannot communicate with remote third-party servers.
• Continuous Integration Egress Audit: Every production build is statically audited in automated CI pipelines. The release build fails closed if any network transmission primitive is detected in compiled artifacts.

3. Declared Extension Permissions & Justifications

Under Chrome Web Store Developer Policies, every declared permission must be strictly necessary and narrowly scoped:

• activeTab: Grants temporary access to inspect the rendered text of the currently active tab only when the user invokes the extension (by opening the popup) or while actively reviewing checkout terms. Text is analyzed in volatile memory and never transmitted.
• storage: Requested to permit clearing the extension's local storage namespace during the Hard Burn routine and to support future local-only settings within the browser's local sandbox (chrome.storage.local). Telemetry, document excerpts, URLs, and scan results are never written to local storage or cloud sync.
• scripting: Used to execute the local document text extraction engine inside the active webpage context to evaluate visible terms and identify dark patterns.

4. Volatile Telemetry & Amnesiac "Hard Burn"

The extension includes local operational telemetry exclusively to power the in-popup Privacy Audit Modal, allowing you to inspect what metadata the application generates in real time:

• Telemetry is stored strictly in a temporary, fixed-size circular memory buffer. It is never written to remote telemetry endpoints, cloud servers, or local storage.
• The "Burn Local Data" Button: When clicked, the extension immediately empties its in-memory telemetry buffer, clears chrome.storage.local, wipes toolbar badges, commands open tabs to tear down any injected scanner instances and cached DOM state, and locks the telemetry system into a permanent no-op tombstone for the remainder of the session.

5. Google Chrome Web Store Limited Use Disclosure

KnowThankYew complies with the Chrome Web Store User Data Policy, including the Limited Use requirements:

• We do not transfer user data to third parties, advertising platforms, data brokers, or information resellers.
• We do not use or transfer user data to determine creditworthiness or for lending purposes.
• We do not use user data for personalized advertisements or commercial profiling.

6. Open Source Inspection & Cryptographic Attestation

Every line of code powering the KnowThankYew Reality Engine is open-source under the MIT License and publicly inspectable on GitHub:

https://github.com/knowthankyew/knowthankyew-extension

Every release includes a machine-readable CycloneDX Software Bill of Materials (bom.json) and SLSA build provenance cryptographically attested via GitHub Actions.