Privacy

Last updated: September 21, 2026

OpenTechCheck is built so that this policy can stay short. The extension analyzes web pages locally in your browser. You can choose to submit a private report to help us improve detection.

The browser extension

• All technology detection runs inside your browser, on your device.
• Fingerprints, icons, and fonts ship inside the extension package. Detection itself makes no network requests.
• Manual reports send a website address only when you press Submit report. Separately, an optional setting can automatically report domains where detection finds nothing, as described below.
• No account or sign-in is required. There is no advertising or general browsing analytics.
• Detection results are kept in temporary browser session storage per tab and are discarded when the tab closes.
• The "Export JSON" and "Copy stack" actions write only to your clipboard or your downloads folder, at your request.

Why the extension requests broad permissions

• host access on all sites — technology detection has to read the page you are viewing. Used to read detection signals locally. Reporting is a separate, voluntary action.
• webRequest — response headers (for example server: nginx) are detection signals. Headers are inspected locally and stored only in per-tab session storage.
• cookies — cookie names (for example laravel_session) identify technologies. Cookie values are matched locally and never transmitted.
• storage — holds per-tab detection results until the tab closes.

This website

• The website sets no cookies and runs no analytics or tracking scripts. The report form stores reports only when submitted.
• The site is served by Cloudflare, whose infrastructure processes standard request logs (IP address, user agent) to deliver the site. See Cloudflare's privacy policy.

Voluntary reports

• No account or GitHub login is required. Opening the report form does not submit a report.
• Reports contain the website address, an automatic category, the extension version when available, and any details or contact email you choose to provide. A random report ID prevents duplicate submissions on retry.
• We remove URL query parameters and fragments. The remaining address is visible and editable before submission. Avoid including private information in the address or notes.
• We do not attach page contents, cookies, browsing history, or detection evidence. Reports are sent over HTTPS and stored in Cloudflare D1, accessible to our authorized team for investigation and follow-up.
• The service uses your IP address for rate limiting; it is not stored in the report table. Cloudflare may process standard infrastructure request logs.

Optional automatic coverage reports

• “Automatically report undetected websites” is off by default. You can enable or disable it in the extension's Coverage settings.
• When enabled, the extension may report a website domain after completed follow-up scans find no technologies. The report contains only the domain: no URL path, query, extension version, page contents, cookies, or user identifier.
• We skip private browsing, local-network websites, failed page loads, and scans whose completion or public connection cannot be verified.
• To avoid repeat submissions within 30 days, the extension keeps hashed domain records locally, with a limit of ten automatic report attempts per day. These records and your setting are not synced to other devices. Older records are removed as new automatic reports are processed.
• The service aggregates reports by domain in Cloudflare D1, adding a category, counts, and receipt times. We do not store the sender's IP address in report tables. Cloudflare processes network metadata to deliver and rate-limit requests.
• Switching the setting off stops future automatic submissions. It does not withdraw reports already received.

Changes and contact

If this policy changes, the change lands as a public commit in the open-source repository before it appears here. Questions or concerns: open an issue.