Extension privacy policy
Last updated: 20 May 2026
Summary
The Defyn BugTrack browser extension lets authorised reviewers leave visual feedback on websites they are reviewing for their organisation. We collect only what is necessary to authenticate the reviewer and to deliver the feedback they explicitly submit. We do not track browsing activity, sell data, or use third-party analytics or advertising.
What the extension stores locally
When you click Connect in the extension popup, the extension signs you into the Defyn BugTrack portal in a hidden iframe. On success, the portal issues a 30-day signed JWT that the extension saves to chrome.storage. This token is the only thing the extension persists. Removing the extension or clicking Disconnect erases it.
The token contains your user ID and an expiry. It does not contain your password.
What the extension sends, and when
The extension is silent on every page until you click the green launcher chip and explicitly submit feedback. Only at that point does any data leave your browser. The submission contains:
- The URL of the page you are leaving feedback on, plus the title, viewport size, and a CSS selector path of the element you pinned.
- A screenshot of the page (captured client-side via
html2canvas), uploaded to the Defyn BugTrack project the recipient is reviewing. - The title and description you typed into the feedback form.
- Your extension token (so the server can verify you have permission to write to that project).
The extension does not transmit anything when you merely browse a page — no telemetry, no page contents, no clicks, no form values.
What is not collected
- Browsing history
- Keystrokes, mouse movements, or scroll behaviour
- Cookies or localStorage on the host site
- Form values you type on other sites
- Tabs you have open, or pages in other windows
- Personal information about you beyond what is in your Defyn profile
Why the extension requests broad host permissions
The extension declares <all_urls> as a host permission because reviewers cannot know in advance which client websites they will be asked to review. The extension uses this permission solely to inject the feedback chip on pages you visit after you click Connect. The chip is dormant until clicked.
Where data is stored, and for how long
Feedback submissions, screenshots, and audit-log entries are stored in our managed Supabase project (Postgres + object storage), hosted on AWS regions we control. Backups follow Supabase's default retention. We retain feedback for the lifetime of the project plus archival; you can request earlier deletion (see below).
Authentication and password hashing is handled by Supabase Auth. We never see your password in plain text.
Third parties
We use a small number of third-party services to operate the product. None of them are advertising, analytics, or behavioural-tracking providers.
- Supabase — database, file storage, and authentication.
- Vercel — web hosting and request logs (standard access logs, no behavioural data).
- Brevo — transactional email (invite acceptance, password reset, feedback notifications).
Your rights
You can request a copy of your data, correct it, or have it deleted at any time. Contact privacy@defyn.com.au and we will respond within a reasonable time.
You can disconnect the extension at any time from the popup. You can uninstall the extension from chrome://extensions.
Changes to this policy
If we materially change what data the extension collects or transmits, we will update the "Last updated" date and, where practical, notify connected users via the portal.
Contact
Defyn Digital — privacy@defyn.com.au