# Baseline — privacy policy

Last updated: 2026-07-15

Baseline is a browser extension that reads the security configuration of pages you
visit and reports it back to you. This policy describes exactly what it does and
does not do with data. It is short because the extension does very little with
data, which is the entire point.

## The one-sentence version

Baseline sends nothing anywhere, has no server, and stores only your settings and
the watchlist you build yourself — all of it on your own device.

## What Baseline reads

When you run a report, Baseline reads, in your browser, only for that report:

- the HTTP response headers your browser already received for the page
- the flags on cookies for that site (`Secure`, `HttpOnly`, `SameSite`) — never
  the cookie values
- elements already present in the page: scripts, stylesheets, iframes, links,
  forms
- the names of keys in the page's `localStorage` — never their values
- the list of domains the page loaded resources from

All of this is information your browser already has. Baseline does not send any
request of its own to read it, and never requests a URL you did not navigate to.

## What Baseline stores

On your device only, using the browser's local extension storage:

- **Your language choice** (`en` or `sv`).
- **Your disclosure signature**, if you choose to set one — your name, used to
  sign the disclosure email template.
- **Watchlist snapshots**, only for sites you explicitly added by pressing the
  star. Each snapshot contains the domain, the page path with identifiers removed
  (`/order/99312` is stored as `/order/*`), the date, the grade, and the state of
  each security header. Snapshots are recorded only when you visit the site
  yourself.

That is the complete list.

## What Baseline never stores or transmits

- It never stores full URLs, query strings, cookie values, `localStorage` values,
  or any page content.
- It never records a history of the sites you browse. Sites you have not added to
  the watchlist leave no trace at all.
- It has no server. It sends no data to the developer or to any third party.
- It contains no analytics, no telemetry, no tracking, and no advertising.
- It loads no remote code and has no third-party dependencies.

## Permissions, and why

- **activeTab / scripting** — to read and display the report on the page you are
  looking at, when you click the icon.
- **cookies** — to read cookie flags. Requested per site, only when you ask, and
  cookie values are discarded before the report is built.
- **storage** — to keep your language, signature and watchlist on your device.
- **optional host access** — granted per site, only when you choose to enable
  cookie checks or tracking for that site. Baseline requests it from a page that
  first explains what Chrome's permission prompt means. It is never requested for
  all sites at once.

## Your control

- Remove any tracked site, or all of them, from the watchlist inside the
  extension.
- Revoke site access at any time in `chrome://extensions` under Baseline's site
  access settings.
- Uninstalling the extension deletes everything it stored. Export your watchlist
  to CSV first if you want to keep it.

## Contact

Baseline is an independent, open project. Questions about this policy can be
raised through the project's public repository.