Privacy policy

Effective date: 5 November 2026.

This policy covers the Curbcut browser extension for Chrome, Edge and Firefox, the Curbcut extension for VS Code (and editors that use Open VSX) and this website (saffo.dev).

Summary

• Checks run on your device, inside your browser or your editor.
• Curbcut has no telemetry and no analytics.
• The only data it sends is your license key, to Polar, when you activate Pro.
• We do not sell or share your data.

What the extension reads

Curbcut reads a web page only after you ask it to: when you click its toolbar button or press its shortcut, the browser gives it access to that one tab until the tab goes to another page. During a Pro site scan, it reads pages of the one site you gave it access to. It reads the rendered page and its styles to check them against WCAG, on your device. Page content, page addresses and browsing history never leave your device.

What the extension sends

Nothing on the free features. When you activate Pro, and you have read the Activate dialog and clicked Activate, Curbcut sends your license key and the label extension to Polar (api.polar.sh) to verify the license. It sends the same to re-check the license at most once every 7 days. Polar replies with the license status and expiry. All of this goes over HTTPS. No other data is sent, and the extension has no server of ours to send anything to.

What the extension stores on your device

• Settings: your WCAG level and whether best-practice rules are on, in the extension's local storage.
• License: the license key, its activation id, status and expiry, in the extension's local storage. The key is shown masked and is never written into web pages, addresses or logs.
• Last result: the result of the last single-page check, in session storage. The browser deletes it when it closes.
• Saved runs (Pro): site scans and Pro runs, in the extension's own IndexedDB.

Nothing is synced across devices. In Firefox private windows, results stay in memory only and nothing is stored.

Your controls

• Deactivate on the options page frees the activation with Polar and deletes the key from your browser.
• Delete data on the options page deletes all saved runs and settings.
• Removing the extension deletes everything it stored.

The VS Code extension

• What it reads: the files you open, and with Pro the files of your workspace when you run Check Workspace. It checks them on your device. Code, file names and paths never leave your device.
• Telemetry: none. It sends no usage data, and it does not use VS Code's telemetry.
• What it sends: nothing on the free features. When you run Curbcut: Activate Pro License and confirm the notice, it sends your license key and the label vscode to Polar (api.polar.sh) over HTTPS to verify the license. It sends the same to re-check the license at most once every 7 days. Polar replies with the license status and expiry.
• What it stores: the license key and its status in VS Code SecretStorage (your system's secure storage). Your settings are normal VS Code settings.
• Baseline (Pro): Curbcut: Save Baseline writes .curbcut-baseline.json in your workspace. It holds rule ids, file paths and element fingerprints, no code, and stays in your workspace unless you commit or share it. Exports are written only to the path you choose.
• Your controls: Curbcut: Deactivate Pro License frees the activation with Polar and deletes the key. Uninstalling the extension removes what it stored.

Third parties

Polar (polar.sh) is the merchant of record for Curbcut sales and the only third party. Polar receives the license key as described above, and the details you enter at checkout (name, email, payment and billing information) under Polar's privacy policy. We see the orders and the email address Polar gives us, and use them only to deliver the license, answer support requests and handle refunds.

Limited Use

The use of information received by the extension, including through browser APIs, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Curbcut uses no Google APIs. The only data it handles off the device is the license key, used only to verify your Pro license. We do not sell it, use it for advertising, credit decisions or any purpose other than the license check, and no person reads it except when you ask us for support.

This website

saffo.dev uses no cookies, no analytics and no scripts. The server that hosts it may record requests (IP address, time, page, browser) for security and to fix errors; we do not use them to track visitors.

Email

If you write to support@saffo.dev, we keep the conversation to answer you and handle your request.

Changes

If Curbcut ever changes what data it sends, we update this policy first and the extension asks for your consent again. The effective date above shows the last change.

Contact

support@saffo.dev