Privacy Policy

1. Who we are

broext.com is run by broext ("broext", "we", "us"). We are responsible for the personal data described here. For anything about privacy, email [email protected].

2. Data about account holders

What	Why	Legal basis (where GDPR applies)
Name, email address and password (stored only as a one-way hash)	Creating your account, signing you in, verifying your email and resetting your password	Contract
Extensions and brands you watch, ownership verification results, and the status and notes you add to findings	Providing the monitoring service	Contract
Billing status: Stripe customer ID, plan, renewal and cancellation dates, card brand and last four digits, and invoice records	Taking payment, showing your billing history, and meeting tax and accounting rules	Contract; legal obligation
Emails we send you (alerts, verification, password resets) and emails you send us	Telling you about new findings and your account, and answering you	Contract; legitimate interests
Technical data: IP address, browser user agent, pages requested and errors	Keeping the Service secure, preventing abuse such as password guessing, and fixing faults	Legitimate interests
Analytics data, only if you accept analytics cookies: pages viewed, referring site, device and browser type, approximate location	Understanding which pages help people, so we can improve the site	Consent

We don't use your data for advertising, we don't sell it, and we don't build profiles of you. We don't make automated decisions about you that have legal or similarly significant effects.

3. Data about extension publishers

broext records information that the Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons publish about each extension. For listings related to watched extensions, it also records the extension's code package. This can include a publisher's name, website, privacy policy link and the contact email shown on the listing. We use it to detect copies and impersonations, and to let real publishers prove that they own their extensions.

• Publisher contact emails are never shown publicly. We use them only to check ownership claims automatically, by comparing them with the email address of the account making the claim.
• The public catalogue shows only information that the stores already make public.
• Our legal basis is our legitimate interest, and the public interest, in helping developers and brands spot copied and impersonating extensions.

If you're a publisher and want us to correct, restrict or remove information about you, email [email protected] with the listing link.

4. Cookies

Always on: cookies the site needs to work.

• Session cookie: keeps you signed in. It expires after 120 minutes of inactivity, or later if you tick "Keep me signed in", which sets a remember-me cookie.
• XSRF-TOKEN: protects forms against cross-site request forgery.
• Cloudflare may set security cookies, such as __cf_bm, to block bots.
• Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud.

Only with your consent: analytics. We use Google Analytics, loaded through Google Tag Manager, to understand which pages are useful. It only sets cookies, such as _ga, if you click "Accept" in the cookie banner. Until then, Google Consent Mode keeps analytics storage off. Advertising features are always off. You can change your choice at any time with "Cookie settings" in the footer. Your choice is stored in your browser's local storage under broext_consent.

We don't use advertising or cross-site tracking cookies.

5. Who processes data for us

We use a small number of service providers. Each one may only use the data to provide its service to us.

Provider	What they do	Location
DigitalOcean	Hosts the broext servers and database	Singapore
Cloudflare	Delivers the website and protects it from attacks	Global network
Stripe	Processes payments and stores card details	United States and other locations
Resend	Delivers emails from broext	United States
Google (Analytics, Tag Manager)	Website usage statistics, only with your consent	United States and other locations
HostGator	Hosts the mailboxes for emails you send to us	United States

We may also disclose data if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of broext. In that last case, this policy would continue to apply to your data.

6. International transfers

Our servers are in Singapore and some of our providers are in the United States, so your data may be processed outside your country. Where the law requires it, these transfers are protected by the providers' standard contractual clauses or equivalent safeguards.

7. How long we keep data

• Account data: until you delete your account. Deleting it removes your profile, watches, findings and notes straight away.
• Server logs: kept for 14 days, then deleted automatically.
• Backups: database backups are kept for 14 days, so data you delete is gone from our backups within 14 days.
• Billing records: Stripe keeps invoices and payment records for as long as tax and accounting law requires, even after you delete your account.
• Emails with us: kept for as long as needed to deal with your request, and then no more than two years.
• Public store listings: kept while they help detect copies, including after a listing is removed from a store, so the history stays reliable.

8. Security

Traffic to broext uses HTTPS. Passwords are stored as one-way hashes. Card details never reach our servers. Access to the server and database is limited and protected by keys. No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.

9. Your rights

Depending on where you live, for example under the GDPR, the UK GDPR, Singapore's PDPA or California's CCPA, you can:

• see the personal data we hold about you and get a copy of it;
• correct it: you can change your name and email yourself on the Account page;
• delete it: you can delete your account yourself on the Account page;
• object to, or ask us to restrict, how we use it;
• withdraw consent where we rely on consent;
• complain to your data protection authority.

To use any of these rights, email [email protected]. We answer within 30 days, and we may ask you to confirm your identity first.

10. Children

broext is a business tool and isn't meant for anyone under 16. We don't knowingly collect data from children. If you think a child has given us personal data, email us and we'll delete it.

11. Changes to this policy

If we change this policy, we'll update the date at the top of this page. For significant changes, we'll also email account holders before they take effect.