Privacy Policy for ExtCafe Chrome Extensions and Website
ExtCafe collects your email and a hashed password if you create an account, basic server logs, and website analytics. It does not sell or share personal data for advertising. The details are below.
Last updated:
Who We Are
ExtCafe ("we," "us," or "our") operates the website extcafe.com and publishes the following Chrome Extensions:
- SEO AI Assistant: SEO Checker, AEO & GEO Audit - an SEO auditing and AI recommendation extension.
- DealFinder - Shopping Assistant - a price-comparison extension for Indian shoppers.
- TrackLens - a web page change tracker that keeps all of its data on your device. See TrackLens below.
This Privacy Policy applies to all products, services, and websites operated by ExtCafe. By using our extensions or website, you agree to this policy.
What Information We Collect
| Data Type | What We Collect | Why |
|---|---|---|
| Account Data | Email address, hashed password, and a record of when and where you agreed to our Terms of Service and this policy (date, policy version, and whether it was on sign-up, login, Google sign-in, the dashboard or the extension) | To create and manage your ExtCafe account, and to show you agreed to the current terms |
| SEO Audit Data | A page summary sent each time you click Analyze: page URL, title, meta description, counts, top words, scores and the 39 check results. Full list below. | To return a written recommendation for each failed check (fixed rules, no AI). On Pro, to generate AI fixes when you ask for them. |
| Subscription Data | Subscription status, plan type, billing dates (via Polar.sh). If you subscribe before creating an ExtCafe account, we keep that subscription under your checkout email until you sign up or log in with it. | To manage Pro plan access and billing, and to unlock Pro for purchases made before sign-up |
| Payment Data | None - all payment processing is handled entirely by Polar.sh | We never see or store your card details |
| Usage Logs | IP address, request timestamps, the analyzed page URL and your plan (server logs). For Pro AI fixes, the generated fix text may also appear in the logs. | Security, rate limiting, abuse prevention and debugging |
| Feedback | The star rating and message you choose to send from the extension, plus your IP address | To read and reply to feedback. Saved on our server and emailed to us. |
| Pro tool usage | Which free Pro tries your account has used, and clicks on locked Pro buttons in the extension (tool name and click type only). Details below. | To give each account one free try of each Pro tool and to learn which Pro tools people want |
| Email preferences | Whether you want product update and offer emails, a random unsubscribe token, and for each of those emails we send you: your address, whether it was delivered and when | To honor your choice, to make one-click unsubscribe work, and to avoid sending the same email twice |
| Analytics | Page views, session data via Google Analytics (extcafe.com website only, and only after you click "Accept analytics" in the cookie banner) | To understand how visitors use our website |
What happens when you click Analyze?
This is exactly what SEO AI Assistant sends, and when, as of version 1.4.x. We checked it against the extension and server code on 12 October 2026.
| When | What is sent | Where it goes |
|---|---|---|
| Every Analyze (free and Pro) | Page URL, title, meta description, canonical URL, whether it uses HTTPS; counts of headings, words, images, images without alt text, links and broken same-site links; the address (first 60 characters) of each image missing alt text; the page's 3 most frequent words and 5 "topic" words; the schema types found; the page-speed reading; the SEO, AEO and GEO scores; and the 39 check results (name, pass/fail, a short status of up to 200 characters, and the fix tip). | ExtCafe's server on Render.com (US). Used to pick the written recommendation for each failed check with fixed rules. Not saved to a database. The page URL and your plan are written to server logs (kept up to 30 days). |
| Pro: "Generate AI fixes" | The same page summary as above. | ExtCafe's server, which forwards it to NVIDIA's AI API to write the fixes. NVIDIA processes it under its own privacy policy. |
| Free Pro tries (logged-in free accounts) | When you use your one free try of AI fixes, competitor comparison, the site audit or llms.txt: the name of the tool, linked to your account. For AI fixes, the same page summary as above (see the Pro row). | ExtCafe's server and database, so each account gets one free try per tool. Kept while your account exists. |
| Clicks on locked Pro buttons (free and logged out) | Only which Pro tool's lock you clicked (for example "competitor") and what you clicked (the lock, log in to try, or start trial), plus your account ID if you're logged in. No page URL, page content or IP address is saved with it. | ExtCafe's database, to see which Pro tools people want. Counted, never sold or shared. |
| Never sent | The page's full text, its raw HTML, form fields, passwords, cookies, your browsing history, and the robots.txt, sitemap.xml and llms.txt files the extension reads to run its checks. | These stay in your browser. |
| Stays on your device | Your audit history, score trends, watched pages, competitor comparisons, site-wide audit results and (Pro) your backlink monitor list. Competitor comparison, site-wide audits, daily watch checks and backlink checks run in your browser; the only server call is the free-try check described above, which sends the tool name and never the pages. Keyword phrases (the Keywords card and the competitor keyword gap) are worked out in your browser from the page's own text and are not sent to our server. | chrome.storage.local in your browser. |
The three scores and all 39 checks are calculated in your browser. How each check works is published on How scores work.
Chrome Extension Permissions Explained
The SEO AI Assistant extension requests the following permissions and uses them only as described:
| Permission | What It Does |
|---|---|
| activeTab | Reads the currently active tab's URL so we know which page to audit when you click Analyze. Access is granted only for the tab where you click the toolbar icon or press the keyboard shortcut; because the side panel stays open as you switch tabs, it asks you to click the icon again on a new tab rather than reading tabs you haven't chosen. |
| sidePanel | Shows the extension's interface in Chrome's side panel next to the page, instead of a popup, so it stays open while you work and can be resized. This permission only controls where the interface is displayed - it does not read any page or collect any data. |
| scripting | Injects a script into a page to read its DOM structure (titles, headings, meta tags, link counts). The script does not read form inputs, passwords, or personal data. Used for the page you're analyzing, for a competitor URL you choose to compare against, for pages crawled during a site-wide audit, and for pages you've opted to Watch (see below) - always limited to reading on-page SEO signals, never form data. During an analysis the script also reads the audited site's own public robots.txt, sitemap.xml and llms.txt files (plus the page's raw HTML) to complete the SEO/AEO/GEO checklist. Those files and the raw HTML stay in your browser; only the checklist results (each check's name, pass/fail and a short status such as "49 chars") are sent with the audit so our server can return matching recommendations. |
| storage | Stores your authentication JWT token, local audit history, score-trend data, and (Pro) the small list of pages you've opted to Watch, plus (Pro) the pages you've added to the Backlink monitor with each one's last result (found, nofollow or missing, and the link text), so you stay logged in and can view past analyses without extra network calls. Nothing is shared with third parties. |
| downloads | Saves the files you generate (Excel/Word/PDF reports, site-audit export, and the Discovery Bundle's llms.txt, llms-full.txt and sitemap.xml) to your computer when you click an export button. These files are built in your browser from the public pages of the site you are on and are not sent to our server. We never download anything without your action. |
| alarms | Pro "Watch this page" and Backlink monitor features: schedules one daily check of pages you've explicitly chosen to watch and of pages you've added to the Backlink monitor. Nothing runs unless you've added at least one page. |
| notifications | Pro "Watch this page" and Backlink monitor features: shows a local desktop notification only if a watched page's SEO score drops, or if a page you're monitoring stops linking to your site or switches its link to nofollow. No notification, no sound, nothing shown if scores are stable - this never sends data anywhere, it's a local Chrome notification only. |
| Host access on extcafe.com | A content script runs only on extcafe.com to securely sync your authentication token to the extension after you log in on our website, keeping you logged in automatically. This does not grant access to any other site. |
| Optional host access (Pro: Discovery Bundle, Competitor Comparison, Site-Wide Audit, Watch, Backlink monitor) | These Pro features need to open pages other than your active tab - a competitor's page, other pages on the current domain during a site audit, or a page you're watching - in a background browser tab to read its SEO signals, then close it. Rather than requesting access to every website up front, we ask Chrome to request it only when you use one of these features, scoped to just that one domain. You'll see a one-time native permission prompt the first time you use a given feature on a given site. The Backlink monitor downloads the HTML of each page you add, directly from your browser, only to look for a link to your site. That HTML is not stored and is never sent to our server. |
The Live Score Badge shows the score on the toolbar icon for pages you've already analyzed - it never triggers a new scan on its own, it only displays a result you already generated.
The DealFinder extension reads product page titles and prices on Amazon.in and Flipkart.com to compare them. No browsing history, purchase history, or personal information is stored or transmitted.
TrackLens: Data Stays on Your Device
TrackLens saves versions of web pages you choose and shows what changed. It sends no page content, screenshots, URLs or browsing activity to ExtCafe or anyone else, and it has no analytics, tracking or advertising.
When you save a snapshot (manually, with the keyboard shortcut, or through a scheduled check you turned on), TrackLens stores the following only in your browser's local extension storage (IndexedDB): the page URL and title, its visible text and a cleaned copy of its HTML, SEO and AEO/GEO fields read from the page (such as title, meta description, headings and structured data), a screenshot (manual snapshots only), your labels, notes, rules, alerts and settings, and your Pro license key if you activated one.
TrackLens makes network requests only to the pages you track, when a scheduled check or "Check now" loads them
in a minimized background window. Site icons come from Chrome's local favicon cache. If you buy Pro, the
license key you enter is checked with our payment provider Polar.sh (api.polar.sh) when you
activate it and at most once a week after that, without any page data, URLs or browsing activity.
| Permission | What It Does |
|---|---|
sidePanel | Shows TrackLens in Chrome's side panel when you click the toolbar icon. |
unlimitedStorage | Lets snapshots and screenshots be stored locally beyond the default quota. |
activeTab | Reads the page you are on only after you open TrackLens or press its shortcut. |
scripting | Runs a bundled function in the chosen tab to read its text, HTML and SEO tags and to scroll it for a full-page screenshot. |
favicon | Shows site icons from Chrome's local cache, so TrackLens never fetches them from the network. |
alarms | Runs scheduled checks of pages you chose to track. |
notifications | Shows a desktop alert when a scheduled check finds a change. You can turn it off in Settings. |
| Optional site access | Requested only when you turn on checks for a site (one site at a time) or choose "Allow on all sites". You can revoke it in Chrome's extension settings. |
Optional access to api.polar.sh | Requested only when you activate a Pro license key, to confirm the purchase with Polar.sh. |
You can delete any snapshot, page or alert, or all data at once, in TrackLens Settings, and export a backup to a file you control. Uninstalling TrackLens removes all of its stored data from your browser.
How We Use the Information
- To provide, operate, and improve our extensions and website.
- To authenticate your account and manage your subscription status.
- To send transactional emails (account verification, password reset, billing and important account notices).
- To send occasional product update and offer emails about ExtCafe's own extensions to verified account holders. Every one of these emails has a one-click unsubscribe link, and you can turn them off any time under Email preferences in your dashboard. Turning them off does not stop transactional emails. These emails are sent from our own aio@extcafe.com mailbox, not a third-party email marketing service, and we do not track opens or clicks.
- To enforce rate limits and protect our services from abuse.
- To analyse anonymous website traffic and improve the user experience.
We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.
How We Store and Protect Your Data
Your account data is stored in a MySQL database hosted on Hostinger. Our backend API runs on Render.com (US region). All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed using bcrypt and are never stored in plaintext.
We use the following third-party processors:
- Polar.sh - subscription billing and payment processing (Polar Privacy Policy).
- Google Analytics - anonymised website analytics (Google Privacy Policy).
- NVIDIA - our Pro AI recommendations are processed via NVIDIA's API (NVIDIA Privacy Policy).
- Hostinger / Render.com - hosting and database infrastructure.
How Long We Keep Your Data
- Account data: retained as long as your account is active. You can delete your account at any time from your dashboard (Delete account). That immediately removes your login, email address, plan record, terms-agreement records, free Pro tries, email preference and the record of which product emails were sent to you; counts of locked Pro button clicks you made are kept without your account ID. If you have a Pro subscription that will renew, cancel it in Manage Billing first. Polar keeps its own payment records under its policy.
- SEO audit data: the page summary sent on Analyze is processed in real time and is not saved to our database. The analyzed page URL and your plan appear in server logs.
- Feedback: kept in a log file on our server with no automatic deletion. Email us to have your feedback deleted.
- Local extension data: stored in your browser via
chrome.storage.local. You can clear it at any time by removing the extension or clearing Chrome's site data. - Server logs: retained for up to 30 days for security and debugging purposes, then automatically purged.
Your Data Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate information in your account.
- Delete your account and all associated personal data, yourself, from the Delete account section of your dashboard, or by emailing us.
- Export your data in a portable format.
- Opt out of analytics by using browser settings or a privacy extension to block Google Analytics.
To exercise any of these rights, email us at aio@extcafe.com. We will respond within 30 days.
Children's Privacy
Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Policy Updates
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users by email. Continued use of our services after changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us: