Privacy Policy for Digital Shield

Effective date: September 5, 2026  ·  Last updated: September 5, 2026

Applies to the Digital Shield browser extension for Google Chrome and Chromium-based browsers.

The short version. Digital Shield does its work inside your browser. Your browsing history, the pages you visit, the contents of those pages, your passwords, your notes and your statistics are stored only on your own device and are never transmitted to us or to anyone else.

Two things do leave your device, and only these two: an optional mailing-list sign-up (your name and email, only if you choose to fill in the welcome form), and your licence key when you activate a PRO purchase. Both are described in full below.

1. Who we are

Digital Shield is developed and operated by Md. Anwarul Islam Shawn, an independent developer, who is the data controller for the limited personal data described in this policy.

Contact for any privacy question, data request or complaint: mdanwarulislamshawn@gmail.com . We aim to reply within 30 days.

2. Personal data we collect

We collect personal data in exactly two situations. There are no others.

2.1 Mailing list — optional, opt-in

When you install Digital Shield, a welcome screen offers to sign you up for occasional product updates. This is entirely optional. Every field is optional, there is a visible “No thanks, continue” button, and the extension is fully functional whether you fill it in or not. Protection is already running before that screen appears; nothing is gated behind it.

If — and only if — you choose to submit that form, the following is sent:

  • First name (optional)
  • Last name (optional)
  • Email address (optional)

Where it goes: the submission is delivered to a Google Form and stored in a Google Sheet in the developer's Google account. Google acts as our processor for this storage; their handling is governed by the Google Privacy Policy .

What it is used for: sending occasional product update emails about Digital Shield. Nothing else.

Legal basis (GDPR): your consent, given by submitting the form. You may withdraw it at any time (see section 8).

If you skip the form, or submit it empty, no request is sent and no row is created.

2.2 PRO licence activation

If you purchase Digital Shield PRO and activate it, the licence key you type in is sent to our payment and licensing provider, Lemon Squeezy, to verify that it is valid and has not exceeded its activation limit. Your name and email are not sent by the extension in this step.

Lemon Squeezy is also the merchant of record for the purchase itself, which happens on their website, not inside the extension. Any payment details you provide are handled entirely by Lemon Squeezy under the Lemon Squeezy Privacy Policy . We never see, receive or store your card or payment information.

After a successful check, the extension stores a single flag, isPremium: true, in your browser's extension storage. It is not linked to an account on our side.

Legal basis (GDPR): performance of a contract — verifying the licence you bought.

3. Data that stays on your device

To do its job the extension necessarily handles a lot of information. All of the following is stored in your browser's own extension storage (chrome.storage.local and chrome.storage.sync) and is never transmitted to us or to any third party:

What Why it exists Where it is kept
Settings and preferences — theme, fonts, protection level, blocking persona, tab-suspender rules To remember how you configured the extension storage.sync, so it follows your browser profile if you have browser sync on
Statistics — trackers blocked, memory freed, tabs suspended, cookies destroyed, caches cleared, streaks, achievements To show you your own counters in the popup storage.local and storage.sync
Per-tab tracker snapshots — which tracker domains were seen on an open tab To display the tracker list and site score for the tab you are looking at storage.local; removed when the tab closes, and orphaned entries are pruned on browser start
Password vault entries (PRO) The optional built-in password manager storage.local, behind the PIN you set. Never synced to us or to any server
Secure notes, bookmarks, email aliases, PIN, locked-tab list Optional features you choose to use storage.local
Your first name, if you entered one Only to greet you by name in the popup storage.sync
Hidden-element selectors, per-site allow and block rules To keep your choices working on later visits storage.local

Website content access

Digital Shield requests access to all websites, and runs scripts on the pages you visit. It needs this to block trackers, detect fingerprinting, apply dark mode and custom fonts, hide elements you asked to hide, show the on-page privacy report, and inspect outgoing requests for the Data Detective feature.

This processing happens locally, in your browser, in real time. Page content, form input, URLs and browsing history are analysed on your device and then discarded. None of it is uploaded, logged, profiled or retained anywhere outside your own browser.

4. Third-party services the extension contacts

These are the only network destinations Digital Shield can reach, and exactly what each one receives:

Service What is sent When
Google Forms / Google Sheets The name and email you typed into the welcome form Only if you choose to submit that optional form
Lemon Squeezy (api.lemonsqueezy.com) Your licence key Only when you activate PRO
Pwned Passwords (api.pwnedpasswords.com) The first five characters of a SHA-1 hash of a password you asked to check — the k-anonymity model. Your password itself is never sent and cannot be reconstructed from it. Only when you run a password check
XposedOrNot and Have I Been Pwned breach lists Nothing about you. The extension downloads the public list of known breaches and compares it on your device. When the breach panel is opened, cached for 24 hours
Google Public DNS (dns.google) The domain name you asked the DNS tool to look up Only when you use the DNS inspector
The website being checked A plain HEAD request to the site itself, to see whether its certificate is trusted When the site safety score is calculated
Krebs on Security and Sophos public RSS feeds Nothing about you. Headlines are downloaded and cached. Periodically, for the privacy news panel

Digital Shield contains no analytics SDK, no advertising SDK, no crash reporter and no telemetry . We do not track how you use the extension.

5. What we never do

  • We do not sell your personal data, and never have.
  • We do not use your data for advertising, ad targeting, or building a profile of you.
  • We do not transfer your data to data brokers, or for creditworthiness or lending purposes.
  • We do not collect or transmit your browsing history, search queries, page contents, form input, keystrokes, screenshots or IP address.
  • We do not transmit your passwords, secure notes or bookmarks anywhere.
  • We do not use your data for any purpose unrelated to the extension's single purpose, other than the product-update emails you explicitly opted into.

Limited Use. Our use of information received from Google APIs and from the Chrome Web Store adheres to the Chrome Web Store User Data Policy , including the Limited Use requirements.

6. How long we keep it

  • Mailing-list entries are kept until you ask us to remove them, or until the mailing list is retired — whichever comes first. Ask and it is deleted.
  • Licence records are retained by Lemon Squeezy for as long as required for the purchase and for their own tax and accounting obligations.
  • Everything stored on your device stays there until you clear it. Uninstalling the extension removes it. Per-tab tracker snapshots are discarded as soon as the tab closes, and the built-in Reset stats button in the popup footer clears every counter and achievement at any time.

7. Security

All network requests the extension makes use HTTPS. Data stored on your device is protected by your browser's own extension-storage isolation: it is readable only by this extension and by anyone with access to your operating-system user account.

The password vault and secure notes are additionally gated behind the PIN you set, and are stored locally only — they are never uploaded, so they cannot be exposed by a breach of ours. As with any local password store, keep your device account secured.

Because we deliberately hold almost no personal data, there is very little for us to lose. If a breach ever did affect the mailing list, we would notify affected addresses without undue delay.

8. Your rights and how to exercise them

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to withdraw consent, and to receive a copy in a portable format.

Users in the EU/EEA and UK have these rights under the GDPR; users in California have comparable rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.

  • Mailing list: email mdanwarulislamshawn@gmail.com from the address you signed up with, or use the unsubscribe link in any update email. We will remove your row from the sheet.
  • Data on your device: you control it directly. Use Reset stats in the popup footer to zero all counters, clear individual features from their own screens, or uninstall the extension to remove everything.
  • Purchase and licence records: contact us and we will assist, or contact Lemon Squeezy directly as the merchant of record.

You also have the right to lodge a complaint with your local data protection authority.

9. Children

Digital Shield is a general-purpose tool and is not directed to children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal data from children.

If you believe a child has submitted their name or email through the optional welcome form, contact us and we will delete it.

10. International transfers

The optional mailing-list data is stored on Google's infrastructure and may be processed in the United States and other countries where Google operates.

Licence data is processed by Lemon Squeezy in the United States. Where required, these transfers rely on the Standard Contractual Clauses or another approved transfer mechanism operated by those providers.

11. Changes to this policy

If we change this policy we will update the effective date above, publish the new version at this address, and — for any change that materially affects how your data is handled — notify you inside the extension before it takes effect.

Continued use after that constitutes acceptance of the updated policy.

12. Contact

Questions, requests or complaints about this policy or your data:

mdanwarulislamshawn@gmail.com