Privacy Policy

Last updated: June 2026

Replay Shield is built to run entirely on your device. It detects session-replay scripts on the pages you visit, shows you what they can capture, and lets you block them. It has no account system and does not collect, sell, or share your personal data.

What stays on your device

Detections and your "caught sites" log (which sites ran a recorder, when, and which vendor) are stored locally in your browser and never leave it.
Your protected-site list and settings are stored in local extension storage.
The recorder signatures used for detection are bundled with the extension. Detection and the Ghost Mirror run on-device with no server, no model download, and no API call.
The Ghost Mirror never transmits anything. It echoes your keystrokes locally to demonstrate what a recorder can receive, and it deliberately excludes password fields. Your typed text is not stored or sent anywhere by Replay Shield.

The only network request

If you subscribe to Replay Shield Pro, the extension contacts Lemon Squeezy once to activate your license. This request includes only your license key — never your detections, your protected-site list, or anything you type. After activation, your Pro status is stored locally on your device, and the extension does not contact any server to re-check it.

An optional signature update (off unless enabled) may fetch an updated recorder list from a public file; it sends no information about you.

What Replay Shield does not do

No analytics, telemetry, or tracking of any kind.
No transmission of your keystrokes, form contents, or browsing history.
No advertising and no selling of data.

Permissions

Replay Shield requests storage (settings, protected-site list, caught-sites log), declarativeNetRequest (to block recorder scripts on sites you protect), activeTab and scripting (to scan the current page and show in-page warnings on demand). The <all_urls> host permission is optional and off by default — it is only requested if you turn on always-on protection, and you can revoke it at any time. There is no baseline access to all your sites and no webRequest permission.

Questions? Email rjsgml5698@gmail.com.