TLDlive Lens Privacy Policy

This policy covers the TLDlive Lens extension ("Lens", "the extension"), provided by TLDlive ("we", "us"). It does not cover other parts of tldlive.com, such as accounts or payments, which have their own terms. This text describes how the extension is designed and is not legal advice.

Summary

• Detection of technologies and site purpose happens in your browser.
• Nothing is sent to TLDlive for statistics unless you opt in on the onboarding page. You can turn it off at any time.
• With opt-in, we receive domain-level observations only. We never receive page content, full URLs, cookie values, form data or personal information.
• We do not sell data. Aggregated, non-personal statistics are published on tldlive.com.

Data we collect, only if you opt in

If you enable sharing, the extension sends the following for sites you visit, at most once per domain per day per installation:

• The registrable domain and host name of the site (for example example.com and shop.example.com).
• The names of detected technologies, taken from the extension's fixed catalogue, with their categories, version if the site exposes one, and a confidence score.
• The purpose category the extension assigned (for example ecommerce, blog or parked) and its confidence.
• The page language, and the schema.org type names found in the page (for example Organization or Product).
• Four yes or no signals: whether the site appears to have a contact page, a privacy policy, a login form and a shopping cart. These are booleans, not the content of those pages.
• Whether the page was loaded over HTTPS, and the time of the observation.
• The extension version and the browser name.
• A random installation ID that the extension generates once and stores locally. Our server stores only a keyed hash of it, not the original value.
• A coarse country, which our server derives from the network connection when the data arrives. We do not store your IP address in observation records.

Observations are queued on your device and sent in batches of up to 50, every 5 minutes or as soon as 25 are waiting. Events that cannot be sent are retried with a growing delay and dropped after 3 days. Turning sharing off deletes anything still queued.

Our servers process the connection to receive this data, which involves your IP address technically. The address is not written to the observation records or to our analytics database. The server uses it only as the key of a short-lived rate-limit counter (a few requests per minute) that expires on its own within about two minutes. Our hosting provider, Cloudflare, also handles the connection as our infrastructure provider and may keep operational logs under its own terms.

Data we do not collect

• Personal data such as names, email addresses, phone numbers or other contact details, from you or from web pages.
• Page content or text, including page titles and meta descriptions. The extension reads the title and meta description on your device to guess the purpose and discards them.
• Full URLs, paths or query strings. Only the registrable domain and host are sent.
• Cookie values. The extension matches cookie names locally for detection and does not send them.
• Form data, passwords or anything you type.
• A record of your browsing history beyond the domain-level, once-a-day observation described above.
• Anything from incognito windows, localhost, private network addresses, browser pages such as chrome://, local files, domains on your denylist, or sites in sensitive categories (for example banking, health and webmail).
• Anything from pages that contain a password field (login pages). This is on by default and can be switched off in settings; the extension then still sends no page content, only the same domain-level observation.

What happens on your device only

Detection reads response headers, meta tags, script and stylesheet addresses, cookie names, selected JavaScript values, DOM markers and a size-capped sample of the page's HTML. These are matched against the bundled catalogue on your device and then discarded. Short-lived scan results for open tabs are kept in the browser's session storage and disappear when the browser closes. Your settings, denylist and installation ID are kept in the browser's extension storage.

The extension asks for permission to run on all http and https pages, to read the main document's response headers (webRequest, read-only; it does not block or change requests), to store settings (storage) and to schedule the periodic upload (alarms). It does not request activeTab. These permissions are used only for detection and for the features described here.

When you open the popup, the extension asks TLDlive for public information about the registrable domain of the current tab, such as status, age, expiry and nameservers. This lookup contains the domain only. It is made whenever you open the popup, even when sharing is off, carries no cookies and no referrer, and is not part of the opt-in observations.

The popup also asks TLDlive for security advisories related to the technologies it detected (the request carries technology names only, for example "WordPress", and no URL or domain). The advisories come from Cloudflare Radar Zero Wire and are shown as related information about a technology, not as a scan or verdict on the site. This request is also made when sharing is off.

Why we use the data

We use observations for one purpose: to produce statistics about which technologies websites use, per domain extension, over time, and to show per-domain technology history. These statistics appear on tldlive.com/technologies and in the product's data. We also use limited technical data to keep the service running, such as rate limiting and abuse prevention. We do not use observations for advertising, profiling individuals or any purpose unrelated to the extension's single purpose.

Retention

• Raw observation events are deleted automatically after 180 days.
• Aggregated statistics, such as counts of domains per technology per day, and the current state of a domain's technologies, are kept indefinitely. They do not contain installation IDs.
• Settings and your installation ID stay on your device until you clear them or uninstall.

Sharing

We do not sell personal data or any observation data. We do not transfer data to advertising platforms or data brokers. Aggregated, non-personal statistics derived from observations are published on tldlive.com and may be available through our API. We use service providers to run the infrastructure that receives and stores the data (for example hosting and a database provider), who process it on our behalf. We may disclose data if required by law, or where needed to protect against abuse, fraud or security threats.

Chrome Web Store Limited Use disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In practice, this means we use data only to provide and improve Lens's single purpose of showing what websites are built with; we do not transfer it except as described above; we do not allow humans to read it except with your consent, for security or abuse investigation, to comply with law, or in aggregated and anonymised form for internal operations; and we do not use it for personalised advertising, credit decisions or any other purpose.

Your controls

• Opt-out toggle. Sharing is off by default and can be switched off in settings at any time. When it is off, nothing is sent.
• Denylist. Add any domain in settings and the extension will not send observations for it.
• Clear data. The settings page lets you clear locally stored data: the queue of unsent observations, the record of domains already sent today, cached scan results and your installation ID. Your settings and denylist are kept. A new ID is generated if you share again.
• Login pages. The "never share pages with a login form" setting is on by default.
• Uninstall. Removing the extension stops all collection and deletes its local storage.
• Requests. Because we store only a hash of the installation ID, we may not be able to find your records unless you provide the ID. Write to us if you need help. Raw events expire automatically after 180 days in any case.

Security

Observations are sent over HTTPS to tldlive.com. The extension never holds database credentials: it sends data to our server, which validates it, applies rate limits and writes it with restricted credentials. Technology names that are not in the allowed format are dropped. Installation IDs are hashed with a server-side secret before storage. No system is perfectly secure, but we limit the data collected so that there is little to protect.

Children

Lens is not directed to children under 13, or the higher minimum age that applies in your country, and we do not knowingly collect data from them. Because the extension collects no personal information and sharing needs opt-in, a child's use does not create a profile. If you believe a child opted in, contact us and we will help to remove what we can.

International processing

Our infrastructure may process data in countries other than your own. We receive only the non-personal observations described above, plus the technical processing of the connection that delivers them.

Changes to this policy

If we change what the extension collects, we will update this page and its date before the change takes effect, and for any new category of data the extension will ask for your consent again. The date at the top shows when the policy was last updated.

Contact

Questions or requests (see also the guides to how the statistics are built, analytics and tag managers and CMS detection): privacy@tldlive.com. For how technology detection works without personal data, see technology fingerprinting and privacy, and for the extension overview, see the Lens page.

Frequently asked questions

Does TLDlive Lens collect my browsing history?

No. With sharing off it sends nothing. With sharing on, it sends a domain-level observation at most once per domain per day, without URLs, paths, page content or your identity.

Is my IP address stored?

Not in observation records or our analytics database. The server derives a coarse country from the connection, and the address is used only for the technical delivery and a short-lived rate-limit counter that expires within about two minutes.

Can I use Lens without sharing?

Yes. Detection and the popup work with sharing off, which is the default.

How do I delete my data?

Use the clear-data setting (it also removes your installation ID) and uninstall the extension. Raw events are also deleted automatically after 180 days, and aggregated statistics do not identify you.