Privacy Policy — Cookie Auto-Sync (Personal)

Last updated: 2026-09-19

1. What data is handled

• Cookies (authentication information) of the websites you explicitly enable in the extension's settings (for example douyin.com, xueqiu.com, mp.weixin.qq.com). Only cookies that already exist in your browser profile are read, and only for the sites you tick. No password, keystroke or form data is read.
• Basic device label (an optional name you type, plus the browser's platform string such as win/x86-64) so the receiving server can tell which of your devices sent the data.

2. Where the data goes

• Data is transmitted only to a self-hosted receiver endpoint that you configure in the settings page (your own machine, or a relay server that you also operate). The default endpoint is your own server, reached over HTTPS.
• If you point the extension at your own relay server, that relay forwards the data to your own home server inside your private Tailscale network (WireGuard-encrypted). The developer never operates, receives, or has access to any of these servers.
• The extension does not send data to the developer, to Google, or to any third party. There is no analytics, telemetry or crash reporting.
• Plain http:// endpoints are blocked unless you explicitly tick the “allow plaintext LAN address” option — an opt-in for your own local network.

3. How data is stored

• Your settings (server address, site list) are stored in chrome.storage.sync so they follow your Google account across your own devices.
• The per-device access token is stored in chrome.storage.local (this device only).
• The extension keeps no copy of your cookies; it forwards them and keeps only a short status summary (time, count, success/failure) shown in the popup.

4. Data sharing and sale

No data is sold, rented, shared, or transferred to anyone. No data is used for advertising, profiling, credit-worthiness, or any purpose unrelated to the single purpose above.

5. Retention and deletion

Because the extension stores nothing beyond your settings and a status summary, uninstalling it removes all extension-local data. Cookies that were forwarded are stored on your own server and can be deleted by you at any time (the receiver keeps timestamped backups that you control).

6. Permissions and why they are needed

• cookies — read the sign-in cookies of the sites you enabled, and detect when a site refreshes its session so the copy stays current. This is the core function.
• storage — save your settings and the last sync status.
• tabs — know when you switch to or finish loading one of the enabled sites, so a sync can be triggered at that moment.
• alarms — periodic fallback sync every 30 minutes.
• Host permissions for the listed websites — required to read those specific sites' cookies.
• Host permission for your own receiver endpoint — required to upload the cookie data to your machine.

7. Security

Transmission uses HTTPS by default. Access to the receiver requires a token; the token is issued per device by a one-time pairing code and can be revoked by the server owner at any time. The extension ships with no embedded credentials: anyone who installs it must obtain a pairing code from the server owner to be able to send anything.

8. Children

This extension is not directed at children and collects no data from them.

9. Changes

Any change to this policy will be published on this page with an updated date.

10. Contact

Questions about this policy: daidai8910g@gmail.com