Privacy Policy & Security Standard
Effective Date: September 20, 2026 • Version 1.2
Checkout Detective was engineered from day one on a strict Zero-PII (Personally Identifiable Information) design philosophy. Our diagnostic engines execute 100% locally within your Chrome browser. We do not maintain backend tracking databases, we do not intercept customer payment records, and we never transmit customer data to any third-party server.
1100% Local In-Browser Execution
When you run an investigation using Checkout Detective, all DOM parsing, cart state tracking, network request timing, and pixel event verifications are executed exclusively in your browser's local sandbox runtime. The extension does not stream DOM snapshots or page interactions to an external API.
All generated reports (HTML, Markdown, and JSON) are compiled directly on your machine using browser-native Blob APIs. When you click "Download Report", the file is saved directly to your local file system without passing through any remote intermediary.
2Zero-PII Data Sanitization & Protection
Ecommerce testing frequently involves mock or real checkout inputs. To ensure no sensitive data is inadvertently recorded during an investigation, Checkout Detective includes an automated in-memory sanitization filter (privacyFilter.ts) that automatically scrubs the following data before logs or reports are compiled:
Automatically detects and redacts 13–16 digit credit card patterns and 3–4 digit security CVV codes in any payload or DOM attribute.
Redacts email addresses, phone numbers, customer billing names, and physical street addresses from form payloads.
Inputs of type password, hidden auth tokens, and session cookies are strictly ignored and never stored in memory.
Zero remote storage. Once you close the tab or reset the investigation, in-memory diagnostic data is cleared immediately.
3Chrome Extension Permissions Explained
Checkout Detective strictly complies with Google Chrome's Manifest V3 security model and requests the absolute minimum permissions necessary to perform technical diagnostics:
- activeTabUsed exclusively to inspect the active storefront tab when you open the side panel or start an investigation. The extension cannot see or inspect your other open browser tabs.
- storageUsed to store your license state (Free, Pro, or Agency), your monthly audit quota counter, and your optional agency white-label settings in Chrome's local storage sandbox (
chrome.storage.local). - webRequestUsed strictly as a read-only listener to detect outgoing advertising pixel beacons (Meta Pixel, GA4, TikTok) and ecommerce cart API calls (
/cart/add.js,/checkout) to identify failed HTTP status codes (such as 422 or 429). We do not modify or intercept request payloads. - sidePanelUsed to render the non-intrusive DevTools companion panel alongside your storefront without interfering with page elements.
4Offline License Keys & Payment Processing
When purchasing a Pro or Agency license, payment transactions are handled securely by our accredited third-party payment processors (such as Stripe or Lemon Squeezy). We never see, process, or store your credit card information.
Your license key (e.g. PRO-XXXX or AGENCY-XXXX) operates as an offline cryptographic key stored within your local browser storage. It does not require continuous tracking telemetry or persistent remote session pings to maintain activation.
5No Third-Party Cookies or Tracking
Neither our website (checkoutdetective.pages.dev) nor our Chrome extension utilizes third-party advertising cookies, retargeting pixels, or behavioral tracking beacons. We do not sell, rent, or trade merchant or user data under any circumstances.
6GDPR, CCPA & Compliance Rights
Because Checkout Detective does not collect, store, or transmit personal data to remote servers, merchant testing conducted with Checkout Detective inherently adheres to the data minimization mandates outlined in the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).
To purge all local data stored by the extension at any time, simply click "Reset Audit" in the extension interface or uninstall the extension from Chrome's Extension Management menu (chrome://extensions).
Questions & Data Protection Inquiries
If you have questions regarding our security architecture, Zero-PII sanitization protocols, or extension permissions, please contact our engineering team directly:
Checkout Detective Engineering & Security
Email: privacy@checkoutdetective.com
Response Time: Within 24 business hours