Privacy Policy

Last updated August 12, 2026 · applies to Chexlist v0.1.0 (V1)

Chexlist is a Chrome extension that turns a web page into a checklist. This policy describes exactly what the current version accesses, stores, and sends — nothing more, since that's all the extension does.

The short version

• Everything Chexlist saves stays on your device, in Chrome's local extension storage.
• There is no account, no sign-in, and no Chexlist server. Nothing is uploaded anywhere.
• There is no analytics, tracking, or advertising code in the extension.
• Chexlist never clicks, types, or changes anything on a page — it only reads and highlights.

What Chexlist stores

When you build a checklist, Chexlist saves it using Chrome's chrome.storage.local API — the same on-device storage every extension uses for its own settings. Two things are stored there:

• Checklists — the name, section labels, instructions, and expected values you type in, plus a ranked list of selector candidates (things like data-testid, aria-label, element attributes, or a structural path) generated from the page element you clicked. No screenshot or image of the element is captured.
• Progress — which items in a checklist you've ticked off, stored separately from the checklist itself so editing one never erases the other.

This data is scoped to your Chrome profile on your device. It is never synced to a server, never transmitted anywhere, and is removed if you delete the checklist or uninstall the extension.

What Chexlist reads from a page

To build and run a checklist, the content script reads the structure of the page you're on — element tags, attributes, roles, visible text, and position — so it can generate reliable selectors and later find and highlight the same elements again. This happens only on pages you use Chexlist on, and only in the page's top frame; content inside cross-origin iframes is not read. None of this page content is sent off your device — it's used in memory, in the browser, to compute selectors and draw the highlight overlay.

"Validate expected value" records what you intend to check — it does not read or compare anything on the page automatically.

Permissions, and why Chexlist asks for them

• storage — save checklists and progress in chrome.storage.local.
• tabs — read the active tab's URL so the toolbar popup can show the checklist that belongs to the page you're on, and open the panel there.
• scripting and host_permissions (http://*/*, https://*/*) — let Chexlist's content script run on the http/https page you choose to use it on, so it can scan for elements and draw the highlight and checklist panel. Chexlist does not run on chrome:// pages or the Chrome Web Store.

What Chexlist does not do

• No accounts, no login, no cloud sync.
• No analytics, telemetry, or crash reporting sent off your device.
• No advertising or third-party tracking scripts.
• No AI processing of your page content.
• No automatic clicking, typing, form submission, or navigation — the extension only points.

Third parties

Chexlist does not share data with any third party, because it does not send data anywhere in the first place. There are no third-party SDKs bundled in the extension.

Changes to this policy

If a future version of Chexlist changes what it stores or accesses, this page will be updated and the "last updated" date above will change accordingly.

Questions

See the Support page for how to reach out.