Privacy Policy

Introduction​

This Privacy Policy describes how Tweak Technologies collects, uses, and protects your data when you use our Products. Your privacy matters to us. In this Privacy Policy:

1. "Products" means our website https://tweak-extension.com, our browser extensions, and any other website or service we operate.
2. "Browser extensions" means all of our browser extensions, currently available for Chrome, Microsoft Edge, and Firefox.

Collection of Information​

We use Google Analytics to collect information about how you use our Products. On our website, this only happens if you accept analytics cookies, see Cookies. Google Analytics also collects information such as device type (mobile/desktop) and approximate geographic location. Our primary purpose in collecting analytics data is to track bugs and enhance the usability of our Products.

Analytics in our browser extensions​

Our browser extensions report usage events to Google Analytics. The following is the complete set of information they send, and it is deliberately short.

• A pseudonymous identifier. A random identifier is generated on your device the first time the extension runs and is stored on your device. It is not derived from anything about you and cannot be used to identify you, but it does allow us to recognise that a series of events came from the same installation. Under the EU General Data Protection Regulation this makes the analytics stream personal data, which is why it is described here. Our legal basis is your consent, which you can withdraw at any time using the switches described below.
• A non-reversible hash of your subscription identifier, sent only while you have an active paid Subscription, so that we can tell paid usage from free usage. This is a one-way SHA-256 digest: we send the digest and never the identifier itself. It stops being sent if your Subscription ends.
• Your approximate country, derived on your device from your browser's time zone setting. We do not send your IP address for this purpose and Google Analytics does not derive your location from the request.
• The extension version, your plan, and the events themselves: which features were used, and coarse size ranges (for example "5-11 rules") rather than exact figures. We do not send your browser's user-agent string.

No URL, request, response, or any other content from the traffic the extension intercepts is ever sent to us or to anyone else. Rules, mocks, payloads, headers, hooks and the addresses you match against stay on your device. Where the extension reports on a rule, it reports flags and fixed categories only (for example that a rule targeted a GraphQL endpoint, or that it used a response hook), never anything you typed.

You can turn this off. In the extension, open Settings > Privacy. "Share usage data" governs all usage reporting; "Report errors" governs error reports alone. Both are on by default and each can be turned off independently, at any time, without affecting any other functionality. Our Firefox extension contains no analytics code at all and reports nothing.

Data Security​

Our browser extensions do not store any application data (a.k.a. rules, a.k.a. mocks) on remote servers at any point in time. All such rules created by the user in our browser extensions are stored on the user's device only. We rely solely on the browser's storage capabilities to store your application data. We do not use storage.sync. All usage information that our Products collect is stored on Google's servers as part of Google Analytics.

Personal Information​

While using our Products, we may collect information that can be used to contact or identify you, as set out below.

Checkout. Your email address is collected during checkout. Payments are processed by our reseller partner Paddle, which acts as the merchant of record and processes payment data in accordance with its own privacy policy. We use your email address to verify with Paddle that you have an active Subscription, to send transactional messages relating to that Subscription, and to enable you to activate the Software on your device.

Sign-in. If you sign in using GitHub, Google or Microsoft, the relevant identity provider shares with us the email address associated with your account. We do not receive your password from these providers. If you sign in with an email code, you give us the address yourself. We use it solely to authenticate you and to associate your sign-in with your active Subscription.

Fraud Prevention and License Enforcement​

To protect the integrity of our paid services and to enforce our Terms and Conditions, our End-User License Agreement, and our Acceptable Use Policy, we process a limited set of technical signals associated with your use of the Software and your Subscription. These signals may include:

• IP Logging. IP addresses associated with your sessions and approximate geographic location derived from IP.
• Device Fingerprinting. Device and browser type, version, and configuration signals that, taken together, form a non-unique fingerprint used to recognize repeat installations.
• Session Telemetry. Login and session timestamps, the number and pattern of concurrent or sequential active sessions, and the number of distinct installations associated with a single license key or account.
• Device Identifier. From 1st November 2026, a random identifier generated when you sign in to a paid Subscription, stored by the extension and linked to that Subscription. It is used to count the Devices on which your Subscription is active and how often it moves between them, as limited by our Terms and Conditions. It is separate from the pseudonymous analytics identifier described above and is never sent to Google Analytics.

We use this information solely to detect and prevent unauthorized sharing of account credentials or license keys, use of a single Subscription by more than one individual or on more than one Device, circumvention of seat, Device or licensing limits, and other forms of fraud, abuse, or breach of our terms. We do not use it for advertising, for behavioural profiling unrelated to license enforcement, or for sale to third parties.

Where we are subject to the EU General Data Protection Regulation or equivalent laws, the legal basis for this processing is, for users with an active Subscription, the performance of our contract with you (Article 6(1)(b) GDPR), specifically our right and obligation to enforce the terms of that Subscription. For users without an active Subscription, and to the extent processing goes beyond what is strictly necessary for contract performance, the legal basis is our legitimate interest in protecting our paid services, our customers, and our business from abuse and fraud (Article 6(1)(f) GDPR), balanced against your privacy rights. We retain this information only for as long as is necessary for these purposes. You may contact us at [email protected] to exercise any rights you may have over this data under applicable law.

Cookies​

A cookie is a small file that a website stores in the browser. This section covers our website, https://tweak-extension.com. Our browser extensions are covered by Analytics in our browser extensions above.

Analytics cookies, only if you accept​

Analytics on our website is opt-in for every visitor, wherever you are. Until you click "Accept" in the cookie banner, the website loads no Google Analytics code, sends nothing to Google Analytics and sets no analytics cookie. If you click "Reject", nothing is collected. If you close the banner with "×", you have not decided: nothing is collected and we ask again on your next visit. Clicking anywhere else on the page is not a choice.

If you accept, the website loads Google Analytics, which sets these cookies:

Analytics data is kept in Google Analytics for 14 months, then deleted. We do not use it for advertising: every advertising signal is switched off. Our legal basis is your consent, and we ask for it again 12 months after you give it.

Changing your mind​

You can change or withdraw your choice at any time from "Cookie settings" at the bottom of every page. If you switch to "Reject" after accepting, the website stops collecting, deletes the Google Analytics cookies and reloads the page. You can also delete or block cookies from your browser's settings.

If the browser sends a Global Privacy Control signal, we treat it as "Reject": the banner is not shown and Google Analytics is never loaded.

Storage the website needs to work​

The following is stored on your device because the website cannot do what you ask without it. It is never used for analytics, so it needs no consent:

• Your cookie choice (_tweak_cookie_consent_v3_, local storage): what you chose and when, so we do not ask on every page.
• Your billing period on the pricing page (monthly or annual), in local storage.
• Checkout and plan activation (__textcom, session storage, deleted when you close the tab): your email address, a sign-in token and the plan you are buying or activating, while you subscribe or activate a plan.
• Site preferences, such as the light or dark theme and your recent documentation searches, in local storage.

Services you start yourself​

These load only when you use them, and only for the service you asked for, so they are not part of the cookie banner:

• Checkout (Paddle). When you subscribe, Paddle, our merchant of record, loads its checkout, which may set its own cookies to process your payment and prevent fraud, under Paddle's privacy policy.
• Sign in with Google. On the subscription page, where you sign in to buy or activate a plan, we load Google's sign-in service so you can sign in with your Google account. Google may set its own cookies under Google's privacy policy. Signing in with GitHub or Microsoft takes you to that provider's own website.
• Sign in with email. When you open the email sign-in form, we load Cloudflare Turnstile to tell people from bots, under Cloudflare's privacy policy. We send the sign-in code to the address you enter through Cloudflare Email Sending, and use the address only to deliver that code and sign you in.
• YouTube videos. Videos on our website show a still image until you press play, and nothing is loaded from YouTube before that. Pressing play loads the video from youtube-nocookie.com, after which YouTube may store data in the browser under Google's privacy policy. If you accepted analytics, we also learn whether you started and finished the video.

Embedded Scripts​

We and our partners, affiliates, analytics, and service providers may also employ software technology known as Embedded Scripts. An Embedded Script is code that is designed to collect information about your interactions with our Products, such as the links you click on. The code is temporarily downloaded onto your computer or other device and is deactivated or deleted when you disconnect from our Products.

Data Retention​

We retain personal information only for as long as necessary for the purposes for which it was collected. Subscription and account records are retained for the duration of your Subscription and for a reasonable period thereafter to comply with our legal, accounting, and tax obligations. Information collected for fraud prevention and abuse detection is retained for the period necessary to investigate, prevent, and act on abuse, and is deleted thereafter unless we are required to retain it longer by law.

Your Rights​

Depending on your jurisdiction, you may have rights in relation to your personal information, including the right to access, correct, delete, restrict, or object to processing, the right to data portability, and the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at [email protected]. We will respond within the time limits required by applicable law.

Changes and updates to this policy​

Tweak Technologies reserves the right to change this policy. If a change is material, Tweak Technologies will provide at least thirty (30) days' notice prior to the new policy taking effect, by in-app notification, by email to the address linked to your Subscription, or by a prominent notice on https://tweak-extension.com. Non-material changes (for example, formatting, typographical corrections, or clarifications that do not adversely affect your rights) may be made at any time. Each time this policy is changed we will revise the "Effective date" at the bottom of this page. Continued use of the Products after the effective date of any change constitutes your acceptance of the revised policy.

Contact​

If you have any further questions regarding this policy, you may contact us by sending an email to [email protected].

Effective date: 1st November 2026