Privacy Policy

Overview

This Privacy Policy applies to the PubSpy.io website and the PubSpy.io Chrome extension. It explains our user data collection, handling, storage, and sharing practices in plain language.

The PubSpy.io Chrome extension helps a user inspect the current tab, detect AdSense publisher IDs, read public ads.txt files, look up related domains, fetch traffic or registration-date data, and request an AI-assisted website analysis in a persistent side panel.

Data the Extension Handles

Data processed on the device

• Current tab information: when you open the extension, it reads the current tab URL, hostname, and page HTML so it can detect publisher IDs and related page signals.
• AI analysis snapshot: when you open the AI panel with auto-start enabled or explicitly request an analysis, the extension extracts a bounded snapshot of visible page text, headings, navigation labels, calls to action, public pricing signals, color and font signals, technology indicators, structured-data types, and linked or resource domains. It also captures the visible viewport for visual analysis after concealing form controls. The extension code never reads form field values.
• AI instructions and conversation: the editable analysis prompt, follow-up questions, and generated answers are handled to provide the report and continued conversation. Report language is inferred from the user's prompt or question instead of being restricted to English or Chinese.
• Account and authentication: PubSpy requires a verified account for AI analysis and billing. Email OTP sign-in processes the email address and a short-lived challenge. Google sign-in processes the verified email, Google subject identifier, and optional profile name or image returned by Google. The website uses an HTTP-only session cookie; the extension exchanges a single-use browser authorization code for a revocable access token. Raw session and access tokens are stored only on the relevant device and only one-way hashes are stored in D1.
• Promotional-credit abuse prevention: PubSpy derives a one-way HMAC from the request IP address to enforce the disclosed monthly signup-grant and daily-claim limits. D1 stores the HMAC scope, grant kind, time window, and idempotency key rather than the raw address in the promotional-credit record.
• Public website files: the extension may request a site's public ads.txt file and extract publisher IDs or seller relationships from that file.
• Search results page scan: on a supported search results page (Google including its country domains, Bing, DuckDuckGo, Yandex, Yahoo, Baidu, Ecosia, Brave, Startpage, Qwant, Sogou, Naver), the extension reads the keyword from the page address without waiting for you to open the panel, and shows that keyword's common suffix domains with their registration date or availability in a card beside the results. It reads no search results and no form values, writes only its own card, and does nothing on a page that has no keyword.
• Lookup results: publisher IDs, domain names, traffic estimates, registration dates, and outbound-domain summaries returned to the extension UI.
• Publisher-domain sync records: when publisher-domain lookup results are rendered, the extension may send the detected publisher ID, related domains, traffic estimates, and registration dates to pubspy.io/api/import/domains so PubSpy.io can deduplicate records and display the publisher domains dashboard.
• User actions: export actions and copy-to-clipboard actions only occur when you click the relevant button.

Data stored locally in the browser

• Temporary caches: the extension stores result caches in chrome.storage.local to reduce repeated lookups and improve speed.
• Recent searches: the extension keeps a short local history of recent publisher-ID lookups, including the publisher ID, related domain count, a small domain sample, and timestamp.
• Settings and derived records: locally stored traffic values, registration dates, and site summaries used to render results faster.
• AI workspace: analysis reports, follow-up conversations, the editable default prompt, English/Chinese interface language, auto-start preference, and the extension access token. At most 15 recent site-analysis sessions are retained locally.

How Data Is Used

We use the handled data only to operate the extension features requested by the user, including:

• detecting AdSense publisher IDs on the page currently being inspected;
• looking up domains associated with a detected publisher ID;
• fetching traffic, WHOIS, and registration-date data for displayed domains;
• rendering the results UI, badge text, export files, and the PubSpy.io publisher domains dashboard; and
• generating evidence-labelled website research with DeepSeek, supporting follow-up questions, and creating local TXT, Markdown, HTML, DOC, or PDF exports;
• maintaining and applying purchased or promotional analysis credits, preventing duplicate charges, and opening a requested hosted checkout; and
• caching recent results locally so the extension is faster and makes fewer duplicate requests.

Data Sent to Third Parties

The extension sends limited site or domain data to third-party services only when needed to complete a requested lookup.

Requests made by the extension

• pubspy.io/api/import/domains: receives publisher IDs, related domain names, traffic estimates, and registration dates from extension lookup results so PubSpy.io can maintain a deduplicated publisher domains database and render the /id dashboard.
• pubspy.io/whois/: current extension builds send domain names here for traffic estimates and WHOIS-style registration details. On a supported search results page the extension also sends the keyword's common suffix domains here so the card can show their registration date or availability; only the keyword read from the page address is sent, nothing else from the page. PubSpy.io injects the server token and forwards the lookup to the whois Worker over a private service binding.
• whoisdomain.charlie0simmon.workers.dev: older packaged extension versions may still send domain names directly to this Worker for the same traffic and registration lookups.
• host.io: receives the detected publisher ID when the extension looks up other domains that appear to use the same publisher ID.
• RDAP registry endpoints: may receive a domain name if the extension needs a registry fallback to obtain registration-date information.
• Public website requests: the extension may directly request https://<domain>/ads.txt from the site being analyzed.
• ZeptoMail: receives the destination email address and one-time sign-in code solely to deliver a requested transactional authentication message. PubSpy does not use ZeptoMail for newsletters in this release.
• pubspy.io/api/analysis: receives an authenticated account token, sanitized site URL without query parameters or credentials, bounded page snapshot and public domain signals, analysis prompt, and follow-up question when applicable. PubSpy.io validates the request, enforces credits and limits, infers output language from user input, and sends the analysis material to DeepSeek. PubSpy.io does not persist the captured page snapshot or prompt in its analysis database.
• DeepSeek: receives the bounded analysis material, a one-way-derived provider user identifier, and optional web-search instructions to produce the requested report. DeepSeek's own Open Platform Privacy Policy and Terms of Use govern its processing, retention, and processing locations. Do not use the AI analysis on private, authenticated, confidential, or sensitive pages.
• pay.yito.ai and Stripe: the hosted checkout receives the PubSpy user identifier, server-selected product SKU, and order reference. Stripe processes payment details on the hosted checkout. The extension and PubSpy.io analysis service do not receive card numbers.

User-initiated external visits

If you click buttons that open websites in a new tab, such as bulk traffic lookups or third-party research links, your browser connects directly to those sites and their own terms and privacy policies apply.

Local Storage and Retention

• Recent searches: stored locally in the browser until you clear them, with the list capped to the latest 50 entries.
• Site and traffic caches: kept locally for short periods that typically range from about 1 minute to 7 days depending on the cache type and result status.
• Registration-date caches: may remain longer because domain registration dates change infrequently.
• PubSpy.io publisher-domain records: deduplicated publisher IDs, domains, traffic estimates, and registration dates may be stored by PubSpy.io to operate the public publisher domains dashboard. These records do not include a full current-tab URL.
• Export files: if you export CSV data, the file is created on your device and saved by your browser.
• AI reports and conversations: retained in chrome.storage.local under the verified user ID and domain until you clear extension data or uninstall the extension, subject to the local 15-session cap. Signed-out or different accounts cannot restore those local sessions.
• Analysis request records: PubSpy.io retains the generated response, analyzed domain, inferred-language mode, request status, model name, token counts, and request fingerprint to preserve idempotency, investigate credit disputes, and provide saved case studies. The captured page snapshot and prompt are not stored in these request records. Use the contact form to request account and case-study deletion.
• Private case studies: a successful initial analysis creates or updates a private 30-section case-study page for that account and domain. The generated report remains in D1 until the account holder requests deletion or the account is removed. It is marked noindex, requires authentication, and is not automatically published to search engines.
• Authentication records: OTP challenges expire after 10 minutes; Google challenges expire after 10 minutes; extension authorization codes expire after 2 minutes; web and extension sessions expire after 30 days unless revoked earlier. Expired security records may be retained briefly for abuse prevention and operational cleanup.
• Credit and payment records: the user identifier, current credit balance, daily-claim date, credit ledger entries, and payment event identifiers are retained as needed to deliver purchased entitlements, prevent duplicate grants or charges, resolve billing issues, and meet operational or legal obligations.
• Promotional grant records: the HMAC IP-address scope, grant type, UTC window, and grant key are retained to make signup and daily allowances idempotent and resistant to automated multi-account abuse.

Data We Do Not Collect

• Core public publisher-ID lookups may work without sign-in, but AI analysis, private case studies, credits, and checkout require a verified PubSpy account.
• We do not read form input values, including password field values, or unrelated browser cookies. PubSpy reads only its own website session cookie and the extension stores its own PubSpy access token. A requested AI snapshot does include bounded text visibly rendered on the analyzed page, which is why private, authenticated, confidential, and sensitive pages should not be analyzed.
• We do not collect card numbers or bank-account details; those details are processed by Stripe on the hosted checkout.
• We do not sell personal information.
• We do not use the extension to create a cross-site advertising profile about you.
• We do not store a full current-tab URL in the extension's recent-search history.

Website Requests

Public website pages use our self-hosted Plausible Analytics at click.pageview.click to measure visits, page views, and referrals. This website tracker does not use analytics cookies. We do not install it in the Chrome extension, sign-in, account, checkout, admin, or private report pages.

The public PubSpy.io website hosts product pages, legal pages, and the publisher domains dashboard. Standard hosting or delivery logs may record basic request metadata such as IP address, user agent, and requested path for security and operational purposes. Extension sync requests are limited to lookup result records used for deduplication and dashboard display; they are not used to build an advertising profile about users.

Your Choices

• You can clear recent searches and cached extension data from the extension interface or by clearing the extension's local storage in Chrome.
• You can uninstall the extension at any time, which stops future extension-side processing.
• You can disable AI auto-start in the side-panel settings and run analyses only when you click the analysis button.
• You can sign out separately from the website and extension. Contact us through the support form to request account or stored case-study deletion.
• Do not open or run the AI panel on private, authenticated, confidential, or sensitive pages if you do not want visible page content and the masked visible viewport sent to PubSpy.io and DeepSeek.
• If you do not want a domain sent to PubSpy.io or third-party lookup services, do not run the related lookup for that domain.

Children's Privacy

PubSpy.io is intended for general business and research use and is not directed to children under 13. If you believe a child has provided personal information to us directly, contact us and we will review the request.

Changes to This Policy

We may update this Privacy Policy when the extension's data practices, permissions, or third-party service usage changes. We will post the revised policy on this page and update the date shown above.

Contact Us

If you have questions about this Privacy Policy or want to request access, correction, or deletion, use: