privacy policy.

this is the privacy policy for pricepulse — the browser extension that adds any web page to a server-side watchlist, re-fetches it on a schedule, and emails you a one-line summary plus a side-by-side diff when text on the page changes. the policy applies to the chrome / firefox / edge extension, the optional account on scrb.voiddo.com if you upgrade to Pro or Pro+, and any data exchanged between them.

voiddo is the data controller. you can reach us at support@voiddo.com for any privacy question.

last updated 2026-04-27 · v1.0 · effective immediately

1. what we collect (and what we do not)

we list every category of data we touch. if it is not in this table, we do not have it.

data category	purpose	retention
your watchlist URLs	required — this is the core feature. each URL you add is fetched server-side on your tier's schedule (weekly free, daily Pro, hourly Pro+). we render and diff its text content; we do not retain the rendered page beyond the snapshot window.	until you remove the entry, your subscription lapses, or you uninstall.
page snapshots (text only)	the text content extracted from each fetched page. used to compute the diff against the previous snapshot. binary content (images, PDFs, etc.) is not retained.	free: rolling 30 days. Pro / Pro+: unlimited (until you remove the URL).
your alert email	optional. if you supply one, we send a one-line change summary plus a deep-link to the diff each time a watched page changes.	until you clear the field in settings or uninstall.
license key (paid tiers)	to validate your subscription against scrb.voiddo.com.	until subscription cancellation + 90 days, or uninstall, whichever comes first.
install_id (free tier)	a 24-character random string generated locally on first install, stored in browser storage. used as the per-install rate-limit key so we can enforce the 5-watchlist-entry free cap without collecting PII. the install_id is the only identifier the server sees for free users.	until you uninstall the extension.

what we do not collect:

• your browsing history (we only see the URLs you explicitly add to your watchlist)
• any page you visit that is not on your watchlist
• cookies, login state, or session data from sites you watch (fetches are unauthenticated — if a page needs login, the snapshot is the public/anonymous view)
• analytics on which sites you watch or how often you log in
• your name, location, IP address (paddle records the billing IP, not us)

2. browser permissions explained

chrome web store and the addons.mozilla.org review process flag every permission your extension requests. here is what each one of ours actually does:

• storage — remember your install_id, your license key (if any), and your settings (alert email, webhook URL, default theme). all values stay on your device.
• activeTab — read the URL of the tab you opened the popup on, so we can pre-fill the “add this page” button. nothing else is accessed; we do not read content scripts into other tabs.

what we deliberately did not request:

• host_permissions — we never read or fetch any third-party origin from your browser. all watchlist fetching happens server-side; your browser is never the user-agent. this means our review surface is the cleanest possible for chrome, firefox, and edge.
• tabs, history, cookies, webNavigation, webRequest — not requested, not used, not relevant.

3. how your data flows

most processing happens on our server, not in your browser. when data must leave your device, we describe the exact flow:

1. you click “+ add this page” in the popup, or paste a URL into settings.
2. the extension sends the URL + your install_id (free) or license key (paid) over HTTPS (TLS 1.3) to our API at scrb.voiddo.com.
3. our scheduler enqueues the URL for periodic fetching at your tier's interval.
4. each cycle, our backend (not your browser) fetches the URL, extracts the text, and computes a diff against the previous snapshot.
5. if the diff is non-trivial, we email the configured alert address with a one-line summary and a deep-link to the side-by-side diff in the extension's full-page UI.
6. we keep an entry in the usage log: timestamp, watchlist entry id, response code, byte count for capacity planning. we do not log the request body or the response body.

4. cookies

the extension itself sets no cookies. our website (scrb.voiddo.com and extensions.voiddo.com) uses two cookies, both strictly necessary:

• session — an httpOnly + Secure session cookie that keeps you logged in to your paid-plan dashboard. expires when you log out or after 30 days of inactivity.
• csrf — an httpOnly + Secure CSRF protection token. expires with the session.

paddle's checkout iframe sets its own cookies for the duration of the transaction; paddle deletes them when the checkout closes.

we do not set analytics, advertising, or behavioural cookies. we do not use cookie banners because we do not need consent for strictly-necessary cookies (GDPR recital 30).

5. legal basis for processing (GDPR Art. 6)

we process your personal data only when at least one of these legal bases applies:

• contract performance — for paid users, we process your billing email + license key because you have entered into a contract for the paid plan. without this data we could not validate your license or send you a receipt.
• legitimate interest — we keep aggregated, non-identifiable usage logs (count of API calls per day, error rates, byte-counts) to operate the service. you can object to this processing at any time.
• legal obligation — we keep transaction records for the period required by tax law in our jurisdiction (typically 7 years).
• consent — for any optional feature that goes beyond the above, we ask explicitly. example: opt-in desktop notifications.

6. sub-processors

we use a small number of third-party services to operate the extension and the optional paid plan. each one processes only the data strictly required for its function. all are contractually bound by data-processing agreements where applicable.

processor	purpose	region
Paddle.com Market Limited	merchant of record for paid plans — receives your billing email, country, payment instrument, issues invoices, handles VAT/sales tax, processes refunds. paddle privacy policy.	UK / EU / US
Resend	transactional email delivery (license key on purchase, change-alert emails, password reset). receives your email address only when we send you a transactional email. resend privacy policy.	US
OVH / DigitalOcean (hosting)	virtual private server in Europe hosting our API endpoints, watchlist scheduler, and snapshot store. processes API requests in transit; logs are kept 14 days then rotated.	EU
our AI engine partner	processes the optional AI tier-extraction request when a Pro/Pro+ user explicitly clicks “extract structured tiers” on a snapshot. we send only the page text for the single request. request bodies are not retained by us; the partner's retention is set to zero on our enterprise contract.	US / EU

we do not use Google Analytics, Meta pixel, Hotjar, or any other behavioural-tracking service.

7. international data transfers

our hosting is in the european union. some sub-processors (Resend, our AI engine partner) are located in the united states. when we transfer your personal data outside the EU/UK, we rely on the European Commission's Standard Contractual Clauses (SCC) as the legal mechanism, supplemented by technical safeguards: TLS 1.3 in transit, AES-256 at rest, and strict access controls. we have completed a transfer impact assessment for each sub-processor and consider the risk acceptable given the limited scope of data shared.

if you would like a copy of our SCCs or the transfer impact assessment summary, email support@voiddo.com.

8. security measures

• all traffic to our APIs uses TLS 1.3.
• credentials (license keys, password hashes) are stored using bcrypt with cost factor 12 or higher.
• API access requires either a per-user license key (paid) or a per-install rate-limit key (free); both are scoped to the watchlist they belong to.
• SSRF guard rejects watchlist URLs that resolve to private IP ranges (localhost, 10/8, 172.16/12, 192.168/16) so the fetcher cannot be used to probe internal infrastructure.
• servers are patched within 7 days of upstream security advisories; critical CVEs patched within 24h.
• operational logs are stripped of personally identifiable information before persistence.
• backups are encrypted and stored in a separate region from production data.
• multi-factor authentication is enforced on every account that can access production infrastructure.
• we have an internal incident response procedure; in the event of a breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Art. 33.

9. your rights under GDPR / UK GDPR / CCPA

if you are in the european economic area, the united kingdom, switzerland, or california (and many other places that have copied these frameworks), you have the following rights regarding your personal data:

• right of access — you can ask for a copy of any personal data we hold about you.
• right to rectification — you can ask us to correct inaccurate personal data.
• right to erasure (“right to be forgotten”) — you can ask us to delete your personal data; if you uninstall the extension, this happens automatically for the local data, and emailing support@voiddo.com gets the server-side data (watchlist + license key + billing email) erased within 14 days.
• right to data portability — you can ask for your data in a machine-readable format (we provide JSON; Pro/Pro+ users also have a CSV export of any watchlist's full snapshot history).
• right to restrict processing — you can ask us to stop processing your data while we resolve a complaint.
• right to object — you can object to our processing on the basis of legitimate interest.
• right to withdraw consent — where we rely on your consent, you can withdraw it at any time.
• right not to be subject to automated decision-making — we do not use your data for automated decisions with legal effect.
• right to lodge a complaint — with your local data protection authority. for EU users, that is the supervisory authority of your country of residence; for UK users, it's the ICO.

california residents (CCPA) additionally have the right to know what personal information we collect, the right to delete it, and the right not to be discriminated against for exercising these rights. we do not sell personal information; “do not sell” requests therefore have no operational effect, but you can still email us to confirm.

to exercise any of these rights, email support@voiddo.com with a subject line that includes the right you want to exercise. we respond within 30 days (typically within 5 business days).

10. children's privacy

pricepulse is not directed at children under 13 (under 16 in some EU jurisdictions). we do not knowingly collect personal data from children. if you are a parent or guardian and believe your child has provided us with personal data, contact us and we will delete it without delay.

11. changes to this policy

we may update this privacy policy from time to time — usually because we have added a feature that processes a new kind of data, or because a sub-processor has changed. when we do:

• we update the last updated timestamp at the top of this page.
• we publish the previous version in our change log.
• if the change is material (we start collecting a new category of data, or we add a new sub-processor), we email all paid users at least 14 days before the change takes effect.
• continued use of the extension after the change takes effect constitutes acceptance.

12. contact

privacy questions, data subject requests, complaints: support@voiddo.com. response within 5 business days; full GDPR-deadline 30 days.

last updated 2026-04-27 · v1.0 · voiddo studio · remote / Israel