# Privacy Policy — Khoj Webscan

Last updated: 2026-08-01

Khoj Webscan is a passive security-scanning browser extension. This policy
explains what data it accesses, what it does with that data, and what it
never does.

## What the extension accesses, and why

| Data | Why | Where it goes |
| --- | --- | --- |
| Response headers of the page you scan | To check for missing/weak security headers (CSP, HSTS, X-Frame-Options, etc.) | Stays on your device. Only requested for a site after you grant that site access. |
| Cookies of the page you scan | To check for missing `Secure`/`HttpOnly`/`SameSite` flags | Stays on your device. Cookie *values* are never read — only name, domain, path, and flag state. |
| Page DOM, inline `<script>` text, forms, `localStorage`/`sessionStorage` **key names** | To check for missing SRI, mixed content, DOM-XSS-sink heuristics, insecure login forms, exposed source maps | Stays on your device. Storage *values* are never read, only key names. |
| Your AI provider API key (Anthropic, Gemini, or DeepSeek) | To call the provider you chose, on your behalf, when you click "Explain" on a finding | Stored only in `chrome.storage.local` on your device — never synced to Google, never sent to Khoj Webscan or any server we operate. |
| Finding evidence (redacted) | Sent to your chosen AI provider only when you explicitly click "Explain," to generate a plain-English explanation | Sent directly from your browser to the provider you configured (Anthropic/Google/DeepSeek), using your own API key. Never routed through a Khoj Webscan server — we don't operate one. |

## What we never do

- We never send crafted requests, fuzz inputs, or probe paths on your
  behalf. All scanning is passive — it only inspects what the page already
  exposed to your browser.
- We never transmit your API key anywhere except directly to the provider
  you selected, from your own browser.
- We never transmit page content, cookies, or storage values to any
  third party except the specific evidence for a finding you explicitly
  chose to "Explain," and even then, only after a redaction pass strips
  bearer tokens, JWT-shaped values, API keys, emails, and URL query
  strings.
- We do not operate any backend server. There is no Khoj Webscan
  infrastructure that receives, logs, or stores your browsing data,
  findings, or API keys.
- We do not sell, rent, or share any data, because we do not collect any.

## Local storage

The extension stores the following in `chrome.storage.local` (never
`chrome.storage.sync`, so it never syncs to your Google account or other
devices):

- Your selected AI provider and API key
- Per-provider last-validated timestamp and cumulative token usage counts
- Cached AI explanations (hashed by rule + origin + evidence, expire after
  7 days)
- Local scan history (origin, timestamp, and finding counts — not full
  finding content) for the last 20 scans

All of this data stays on your device and is deleted if you uninstall the
extension or clear the extension's storage.

## Site permissions

Khoj Webscan requests host access (needed to read response headers and
cookies) one site at a time, the first time you scan that site, via
Chrome's permission prompt. You can review and revoke per-site access at
any time from the extension's Settings page ("Site access" section).

## Third-party AI providers

When you use the "Explain" feature, redacted finding evidence is sent
directly from your browser to the AI provider you configured, under your
own account and API key. That provider's own privacy policy and terms
govern how they handle the request:

- Anthropic: https://www.anthropic.com/legal/privacy
- Google (Gemini): https://policies.google.com/privacy
- DeepSeek: https://www.deepseek.com/en/privacy-policy

Khoj Webscan has no involvement in, or visibility into, how these
providers process that data.

## Changes to this policy

If this policy changes, the "Last updated" date above will be revised and
the change will be noted in [CHANGELOG.md](CHANGELOG.md).

## Contact

This is an open-source project. Questions or concerns about privacy can be
raised via the project's issue tracker.