Privacy Policy

Website Whitelist | Parent Control — Chrome Extension

Last Updated: August 14, 2026

Website Whitelist (“Website Whitelist,” “we,” “us,” or “our”) is a Chrome browser extension that restricts browsing to a user-defined allow-list of websites. This Privacy Policy describes, in full, what information the extension and its optional paid (“Pro”) features collect, how that information is used, how it is stored, who it is shared with, and the choices you have.

This policy applies to the Website Whitelist Chrome extension, the account/subscription system behind its Pro features, and the pages the extension opens on website-whitelist.com (welcome, blocked, and uninstall pages).

1. Summary of Data We Handle

We do not collect location data, health information, personal communications (emails, texts, chat logs), or keystroke/analytics data about your general browsing.

2. Website and URL Data (Core Whitelisting Function)

To block or allow a page, the extension needs to see the hostname of the page you’re about to load — this is what the declarativeNetRequest, webNavigation, and host permissions are used for. Specifically:

• The extension compares the hostname of each navigation against the domains in your local whitelist, entirely on your device.
• If the hostname is not on your whitelist, the navigation is redirected to the extension’s own “blocked” page, which shows you the URL that was blocked so you know what happened.
• We do not log, store a history of, or transmit the URLs or pages you visit to us or to any third party. No browsing history ever leaves your browser.

3. Your Whitelist and Extension Settings

The following is stored using Chrome’s built-in chrome.storage.sync API, which lives in your browser and — if you are signed into Chrome — is synced across your own signed-in devices by Google, the same way your bookmarks or browser settings are. It is not sent to our servers:

• Your whitelisted domains and the on/off state of blocking;
• Pro schedule windows (days/times blocking should be active) and Hard Lock focus-session state, if you use those features;
• A custom blocked-page title/description, if you’ve set one;
• Review-prompt state (e.g., whether you’ve already answered or snoozed it) and the install date, used only to time that one in-app prompt.

Because this data is synced by Google’s Chrome Sync (a service you control in your own Google Account), Google processes it as part of that sync infrastructure under Google’s own Privacy Policy. We do not have a separate copy of this data on our servers, and we cannot access it.

4. Password Protection

If you set an in-app password to lock the extension’s settings, we hash it with bcrypt (a one-way, industry-standard algorithm) and store only that hash in chrome.storage.sync. The plain-text password is never stored or transmitted anywhere, including to us — we have no way to recover it if you forget it.

5. Pro Subscription and Payment Data

Website Whitelist offers an optional paid “Pro” tier. Payment is processed by Stripe, a PCI-compliant third-party payment processor. The following applies only if you choose to purchase Pro or restore a purchase:

• Licence key (apiKey): on first run, the extension registers with our self-hosted payments backend and receives a random per-install licence token. This token (not your password, not your identity) is stored in chrome.storage and sent with each request so the backend can look up your subscription status.
• Email address: collected by Stripe Checkout when you pay, and stored on our backend against your licence token. We use it only (a) as part of your Stripe receipt, and (b) to look you up if you use the “restore purchase” flow after reinstalling the extension.
• Subscription/payment status: whether you’re paid, your plan name, subscription status, and renewal date are stored on our backend and read by the extension to unlock Pro features.
• Stripe customer/subscription IDs: stored on our backend to communicate with Stripe (e.g., to open the billing portal). These IDs are never sent back to or readable by the extension itself.
• Card / payment details: entered directly into Stripe’s own Checkout and Billing Portal pages. We never see, receive, or store your full card number — only Stripe does, under its own PCI-DSS compliant systems.
• Restore-purchase proof: if you lose your licence key, you can restore access by submitting your email plus either the last 4 digits of your card or a Stripe invoice number. This proof is sent to our backend, which verifies it directly against Stripe’s records, then returns your existing licence key. We do not store full card numbers as part of this process, and repeated failed attempts are rate-limited and temporarily locked out to prevent abuse.
• IP address: briefly used server-side to rate-limit abuse of the registration and restore endpoints (for example, to stop someone from mass-creating licence tokens or brute-forcing the restore flow). These rate-limit records automatically expire; we do not build a profile of your IP address or location.

Your subscription and account data is stored in a MongoDB Atlas database and served by our backend hosted on Vercel — both act as our data processors/hosting infrastructure and do not use your data for their own purposes. This data may be processed on servers located outside your country of residence.

We do not use your email, payment status, or any Pro-account data for advertising, profiling, or behavioral tracking, and we never sell it.

6. Pages Opened Automatically by the Extension

The extension opens a page on website-whitelist.com when you first install it (welcome) and if you uninstall it (goodbye/feedback). These are regular web pages on our marketing site, not part of the extension itself, and use standard, aggregate Google Analytics website analytics (page views, general location, device type) the same way most websites do. This is separate from, and unrelated to, the whitelist, browsing, and account data described above, and no data from inside the extension (your whitelist, your browsing, your account) is passed into these pages.

7. How We Use Data

In summary, information described above is used only to:

• Allow or block websites according to your whitelist settings, entirely on-device;
• Store and apply your extension preferences and Pro feature settings;
• Register, verify, and unlock your paid Pro subscription, and let you manage or cancel it;
• Let you restore access to Pro after reinstalling the extension;
• Prevent abuse of our registration/restore endpoints;
• Provide customer support if you contact us.

We do not use any of this data for advertising, profiling, or behavioral tracking, and we do not sell it.

8. How We Share Data

We do not sell, rent, or trade your data. We share data only with the service providers necessary to operate the features above, each acting under their own security and privacy obligations:

• Stripe — payment processing (see Stripe’s Privacy Policy);
• MongoDB Atlas — database hosting for account/subscription records;
• Vercel — hosting for our payments backend;
• Google Chrome Sync — for whitelist/settings data, if you are signed into Chrome (governed by your own Google Account settings, not by us).

We may also disclose information if required by law, legal process, or a valid governmental request.

9. Data Retention and Deletion

• Whitelist and settings data lives in your browser’s storage and is deleted when you remove the extension or clear its storage.
• Your Pro account record (licence token, email, subscription status) is kept on our backend for as long as your install/subscription is active, so Pro can be restored after a reinstall.
• You can request deletion of your Pro account record — including your email address and licence token — at any time by contacting us (below). Deleting the record ends your ability to restore that subscription on a new install.

10. Your Choices and Control

You can, at any time:

• Add or remove websites from your whitelist, or turn blocking on/off;
• Disable or remove the extension from Chrome, which deletes its locally stored settings;
• Cancel or manage your Pro subscription yourself via Stripe’s Billing Portal, opened from the extension’s “Manage subscription” option;
• Request a copy or deletion of the account data described in Section 5 by emailing us.

11. Children’s Privacy

Website Whitelist is designed, in part, as a parental-control tool used by a parent or guardian to manage a child’s website access. The extension itself does not require a child to provide any personal information. Where Pro is purchased, the account/payment information described in Section 5 belongs to the purchasing adult, not the child using the browser.

12. Security

Whitelist and password data stay on your device (and, if applicable, your own Google Chrome Sync) and are never transmitted to our servers. Pro account data is protected with encrypted connections (HTTPS), a secret, per-install licence token rather than a password, and access controls on our backend and database. Payment details are handled entirely by Stripe’s PCI-compliant systems and never touch our servers. No method of transmission or storage is 100% secure, but we take reasonable, industry-standard measures to protect the data we hold.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to Website Whitelist, applicable laws, or our data practices. Material changes will be reflected by updating the “Last Updated” date above. Your continued use of the extension after a change becomes effective constitutes acceptance of the updated policy.

14. Contact Us

Questions about this Privacy Policy or our data practices, or requests to access/delete your Pro account data, can be sent to eddundeadd@gmail.com or via website-whitelist.com.

15. Chrome Web Store Limited Use Disclosure

Website Whitelist’s use of information received from Google APIs, and its use of Chrome extension permissions, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:

• Website/URL access (host permissions, declarativeNetRequest, webNavigation) is used only to enforce your whitelist locally on-device, and for no other purpose.
• We do not use this data for serving advertisements, and we do not sell it or transfer it to third parties, except as described in Section 8 to operate the paid subscription you explicitly opt into.
• Where personal data (email, subscription status) is collected for the Pro tier, it is used solely to provide and support that feature, is not used for unrelated purposes, and is not shared for advertising.

Website: https://www.website-whitelist.com/