What the extension sends, and what it never touches

Nothing is sent until you click. There is no background collection, no scan on page load and no scan of tabs you are not looking at.

Always, when you scan:

• The address of the tab you scanned, stripped. The query string is reduced to variant and sku, and the fragment is dropped, in your browser, before the request is assembled. Session tokens, affiliate ids, click ids and email-campaign parameters all live in query strings and none of them reaches us. variant and sku stay because they select which product the page is showing, so dropping them would point us at a different item than the one you are looking at.
• A page kind, which the extension works out from the address alone: one of product, collection, home or other.
• A random install identifier and a proof of work value, sent as request headers. Neither identifies you. See Anonymous by default.

Additionally, only when the browser view option is switched on:

An extract of the page, read from what your browser has already rendered. This is what lets the panel tell you that something a shopper can see is missing from what an agent is served. It contains:

• the page title and its H1 headings
• structured data: the bodies of the page's JSON-LD blocks, up to 32 blocks and 32KB in total, plus the @type and itemtype names found on the page
• meta tag names and values, up to 40 of them
• price shaped strings visible on the page, availability text, and whether an add to cart control is present
• counts only: how many words are visible, how many script tags there are, how many JSON-LD blocks there are, and how many bytes the extract came to
• up to 2,048 characters of visible text from the page's main content region
• the page address a second time, this one reduced to a whitelist of variant and sku, with everything else in the query string and the fragment dropped

Before any of that leaves the page, three redaction passes run in your browser, not on our servers. Email addresses become [email removed]. Digit runs that are the length of a payment card and pass the Luhn check become [number removed]. Phone shaped strings become [phone removed]. In the free text sample only, any remaining run of four or more digits is also removed, with prices deliberately kept because prices are the thing the scan exists to measure.

The extract is read from rendered text, never from page markup, so no script bodies, no inline event handlers and no hidden attributes travel with it.

• Cookies. The extension does not request the cookies permission, so Chrome does not give it the ability to read them, on any site.
• Local storage, session storage and IndexedDB. The extension reads none of them on any page you visit. The storage permission it does hold writes only to the extension's own storage, and only four things: its install identifier, your browser view preference, which panel sections you have expanded, and, for the length of one browser session, which tab your last click granted access to. None of the last three is ever sent to us.
• Credentials. No passwords, no session tokens, no authorization headers, no API keys. The extension has no sign in and no account, so there is nothing for it to attach a credential to.
• Form fields. Before any text is read, inputs, textareas, selects, options, buttons, forms and contenteditable regions are removed from a working copy of the page. Whatever you have typed lives in exactly those elements, and they are gone before the text extraction starts.
• Other tabs. The extension does not hold the tabs permission. Access is granted one tab at a time by your click on the Cresva icon, and it does not carry over to the next tab or the next page.
• Anything at all, until you click. The extension declares one host permission, https://cresva.ai/*, which is our own API. It holds no standing permission on any store you visit.

On these pages no request leaves your browser at all. Not a redacted request, and not a scan with the browser view turned off. Nothing. The refusal happens before a request is even assembled, because the address by itself is a disclosure: a Shopify admin URL tells us which store somebody administers and which order they were reading.

Refused by host:

admin.shopify.com, partners.shopify.com, accounts.google.com, myaccount.google.com, admin.google.com, login.microsoftonline.com, and any subdomain of those.

Refused by path, anywhere in the address:

admin, wp-admin, wp-login, administrator, checkout, cart, account, orders, order-status, my-account, profile, addresses, payment and billing. File extensions are stripped before matching, so /wp-login.php and /admin.aspx are refused too.

Refused because of what is on the page:

Any page carrying a password field. This one cannot be decided from the address, so it is checked a second time after the page has been looked at. When it fires, the extract already held in the extension's memory is discarded unsent and unlogged, and the scan ends there.

Browser pages are also refused: chrome://, about:, devtools://, view-source:, extension pages, and anything that is not http or https.

One row is written per scan. It holds:

• the hashed install identifier, never the raw one
• the host, and the page address in the stripped form above
• the page kind
• the verdict and the individual check results, including the short evidence strings the panel shows you
• whether a browser view extract arrived and how many bytes it came to, which is a size and never any content
• the engine version, how long the scan took, and the timestamp
• where we could work them out from the store itself, a category and a shipping country, used only for the comparison line

The page text extract is never stored and never logged.

The up to 2,048 character text sample is used inside one comparison on the server and then dropped. It is not written to the database, it does not appear in any log line, and it is not returned in the response. What is kept about it is a boolean and a byte count.

Be aware of the one thing that does cross over: the short evidence strings in the stored check results are quotations from your page, so a page title or a price the page displays can appear there. Those are the same strings the panel shows you on screen.

Caching.

A verdict computed from a page we fetched ourselves is cached for one hour, keyed by host, so a repeat scan of the same store costs nothing. A verdict computed with help from your browser extract is never cached, because it describes one person's browser session and must never be served to a second person.

Your IP address.

Used as a rate limiting key, held in a short lived counter that expires on its own. It is not written to the scan record.

Two uses, and no third.

• Producing the report you asked for, in the panel, at the moment you asked for it.
• Aggregate readiness statistics. Stored verdicts are counted together so the panel can tell you where a store stands against others in the same category and country. That comparison is only shown once at least thirty comparable stores exist, and it is a count of bands and never a list of stores.

We do not sell this data, and we do not share it with advertisers, data brokers or any third party for their own purposes.

A scan makes no calls to any AI model. The analysis is code reading your page, not a model reading it, and there is therefore no third party model provider in this path and nothing to train on.

How long we keep it.

90 days. A job runs every night and deletes every scan record older than that. It is not a policy we apply by hand on request: it is a scheduled deletion, it records what it deleted each night, and the number above is read from the same constant the deletion uses, so this sentence cannot quietly drift away from what the code does.

You can also ask us to delete yours sooner. Write to us at the address below.

There is no account, no sign in, no email address and no connected store. The extension asks you for nothing and we do not know who you are.

• The install identifier is a random UUID your browser generates once, at install, from the platform's cryptographic random source. It contains nothing about you or your machine.
• It is kept in the extension's local storage and deliberately not in Chrome's sync storage, so it does not replicate to your other machines.
• It is sent as a request header and stored only as a SHA-256 hash. The raw identifier is never written to our database.
• It is a rate limiting partition key and nothing else. Your browser mints it, so it proves nothing to us and cannot be used as a credential.
• Uninstalling the extension removes it. A fresh install mints a new one, unlinked to the old.

If we change what a scan sends, what is stored, or how long we keep it, we will update this page and move the date at the top of it. Material changes will also be noted in the extension's Chrome Web Store listing, which is the surface that tells you an update has been installed.

Privacy questions, deletion requests and anything on this page you think is wrong: hello@cresva.ai.

Cresva, Inc., Delaware, United States. This policy supplements the general privacy policy at /privacy, which covers cresva.ai and the signed-in product. What the extension actually does is described at /extension.