Privacy you can understand.

The extension makes exactly one kind of network request, and only if you are a paying customer: an occasional call to superblurai.com/api/restore to refresh your license code before it expires. It carries your signed license code and nothing else — no page content, no URLs, no settings. The code contains your purchase email, and the server receives ordinary connection metadata.

An extension without an activated code makes zero network requests. Ever. You can verify this yourself: inspect the extension service worker in browser developer tools. You can also inspect the packaged scripts; the bundled regex engine is reproducible from the supplied source and dependency lockfile.

• The content of any page you visit — all detection runs in your browser.
• Detected page content is not sent to our servers.
• Custom rules, site policies and settings use local or browser sync storage. Your browser provider handles sync when enabled.
• Revealed-item exceptions store SHA-256 hashes, short hints and scope information locally. Predictable values can be guessed; hashes are not encryption. Manual selected-text rules and backups can contain the selected text.
• Usage data: there is no analytics library, no telemetry, no error reporting, no usage tracking. License tokens contain the purchase email.

SuperBlur asks for the minimum Chrome allows for what it does:

• storage — save your settings and rules locally (and sync them via your browser’s own sync, if enabled).
• idle — power the “blur when I step away” trigger.
• contextMenus — the right-click “Blur selection” item.
• activeTab — user-invoked controls on the current tab.
• tabs — route automation and shortcuts across tabs.
• alarms — license refresh and screen-share session cleanup.
• host access — content scripts must run on the pages you want blurred; that’s what a blur extension is. Content scripts run on supported web pages and frames, including background tabs.

Not requested: browsing-history permission, webRequest, cookies, downloads, nativeMessaging — none requested.

Sign in with Google to connect your account. The extension verifies signed access on your device, with an online recheck at least every 24 hours and approximately every 30 minutes while running. A refund or revoked subscription stops new access at the next successful check, or when the offline lease expires. Existing visible masks remain in place when access expires; new protection requires an active trial or subscription. Page contents are not sent for these checks.

• Blur is visual, not redaction. The text stays in the page’s code: selectable, copyable, visible to screen readers and scrapers. SuperBlur protects against human eyes on your screen — shares, demos, shoulder surfing — not against software inspecting the page.
• Heavy blur beats light blur. Very low blur on short strings can in principle be reconstructed from a high-resolution screenshot. Keep intensity at the default or higher for anything that matters.
• Some corners of the web are unreachable by any extension: closed shadow DOM, certain sandboxed iframes, and non-web apps (native Zoom windows, Figma canvas). We document these instead of pretending.
• Screen-share detection sees browser-based shares (Meet, browser Zoom, Loom’s web capture). A share started from a native app is invisible to a browser extension — turn blur on manually before those.

Found something? Email achleshavarshney@gmail.com with “security” in the subject. We respond within 48 hours, fix confirmed issues with priority over all other work, and will credit you in the changelog if you’d like.