Privacy and permissions
What the VitalSentinel SEO Extension stores in your browser, what it sends and to whom, and why it needs each browser permission.
The VitalSentinel SEO Extension does its work in your browser. It reads the page, its response headers and its redirect chain itself. It fetches robots.txt, the sitemaps and the raw HTML directly from the site. No VitalSentinel server is between you and the page.
The extension does not keep or sell your browsing history. Apart from the Domain Rating lookup and your own monitored sites, it sends nothing about the pages that you visit.
Before you start
- The extension asks for your consent on the welcome screen before it sends anything. See Install the extension.
- You can change each choice later in Settings.
- Offline mode stops every request except the requests to the site that you are on.
What leaves the browser
| Recipient | What | When |
|---|---|---|
| The site that you are on | Normal requests for the raw HTML, robots.txt, the sitemaps, llms.txt, the favicon and link checks | When you open a report that needs them |
| Hosts in the robots.txt or the sitemap index of the site | Requests for those sitemap files | When a report checks if the page is in a sitemap. Only the current host in offline mode |
| Sites that the page links to | One request for each link, to read its status | Only when you click Check status in the Links report |
| Hosts of the images of the page | A normal image request, without a referrer | When the Images or Social tags report is open. Never in offline mode |
| VitalSentinel | The registrable domain of the current tab, never the full address. No sign-in token | Only if the Domain Rating lookup is on. About once a week for each domain. If a lookup fails, the extension tries again after one hour. Never for incognito tabs |
| VitalSentinel, when you are signed in | Requests for your name or email address, your workspaces and roles, and your domain list | At most once an hour |
| VitalSentinel, when you are signed in | The full address of the current tab, without the part after # and without tracking parameters | Only if the host is one of your monitored domains. At most once an hour for each page, or when you click Refresh |
| VitalSentinel, usage and error counts | Daily counts from a fixed list, with the extension version, the browser, the language and a few settings as on or off | One report for each day that you used the extension, sent the next day. Only if you turned on the counts. Never in offline mode |
| Ahrefs, from the VitalSentinel server | The domain only | When VitalSentinel has no current Domain Rating for the domain |
When you click a link such as Rich Results Test, Schema.org validator or Run on PageSpeed Insights, the address of the page goes to that site in the link.
Usage and error counts
The counts tell VitalSentinel how often features were used and how often something failed. A report contains the day, the extension version, Chrome or Edge, the language of the browser and if you are signed in. It also contains the counts, for example how often you opened a report or ran a link check.
A report never contains page or site addresses, titles, content or check results. It never contains Core Web Vitals values, Domain Rating values, account or workspace IDs, email addresses, cookies or error messages. The extension sends it without a sign-in token, without cookies and without an install ID. So VitalSentinel cannot connect a report to your account, or to other reports from the same browser. The extension does not count actions in incognito tabs.
Domain Rating
VitalSentinel keeps each Domain Rating for 7 days. It stores no user and no IP address with the Domain Rating data. It keeps only the domain, the score, the date of the lookup and a count of the lookups for each domain.
What the extension stores in your browser
| Data | How long |
|---|---|
| The status, response headers and redirects of the page load in each tab, without cookie values, and its Core Web Vitals | Until the next page load in the tab, or until you close the browser |
| The last report that you opened in each tab | Until you close the tab or the browser |
| Your settings and JavaScript rules | Until you change them, or until you remove the extension |
| The Domain Rating of each domain | 7 days. Deleted when you turn off the lookup or the badge |
| Signed in: your name or email address, workspaces, roles and domains | Refreshed after 1 hour. Deleted when you sign in or out, or when the app does not accept your session |
| Signed in: the VitalSentinel data of the monitored pages that you opened | Refreshed after 1 hour, at most 50 pages. Deleted when you sign in or out, when the app does not accept your session, or when you close the browser |
| The sign-in tokens | The access token: 60 minutes, or until you sign out or close the browser. The refresh token: until the extension uses it, or until you sign out |
| Usage and error counts that are not sent yet | Until they are sent, at most 7 days |
| The page summaries for Changed since your last visit | 30 days and at most 2,000 addresses. Deleted when you turn off the history or clear it |
When you remove the extension, the browser deletes all of this data. The "Clear browsing data" function of Chrome does not clear the storage of the extension. Use Clear history in Settings, or remove the extension.
The sign-in tokens never go to a web page. Only the background part of the extension keeps them and uses them.
Permissions
The extension asks for access to all sites. It must read the headers and the redirects of any page that you open. It must also fetch robots.txt, the sitemaps and the raw HTML from that site.
| Permission | Why the extension needs it |
|---|---|
Access to all sites (<all_urls>) | To read the response headers and redirects of the page, and to fetch the raw HTML, robots.txt, sitemaps and link status from the site |
webRequest, webNavigation | To read the status, the headers and the redirect chain of each page load. Only the main page, not its files. The extension only reads and never blocks |
contentSettings | To allow or block JavaScript for a site |
cookies | To list the cookies that the page set, with their flags, for the Tech and tracking report |
scripting | To add the analysis, axe-core and the overlays to the current tab when the popup asks for them |
identity | To sign in to VitalSentinel |
storage | To keep the settings, the JavaScript rules, the page records, the tokens and the page summaries |
contextMenus | To add the JavaScript switch to the right-click menu |
What runs on each page
Only one small script runs on every page. It measures the Core Web Vitals of the page load. It reads nothing else from the page and makes no network request.
All the other code, for example the analysis, axe-core and the overlays, goes into a page only when you open the popup. This code reads the page and does not change it, except for the overlays and highlights that you turn on.
Your rights and contact
You can ask for access to your personal data, and for its correction, deletion or restriction. To send a privacy question or request, write to privacy@vitalsentinel.com. For your VitalSentinel account, see Data and privacy.
Related
- Settings - offline mode, the history and the usage counts
- Sign in - what the extension loads when you are signed in
- Connected apps - revoke the access of the extension in the app
Settings
The Settings page of the VitalSentinel SEO Extension controls your account, JavaScript rules, the toolbar icon, offline mode, the page history and the usage counts.
Troubleshooting
Solutions for common problems with the VitalSentinel SEO Extension, for example pages that it cannot check, missing headers, a missing Domain Rating and missing VitalSentinel data.
