Privacy policy

The short version

• This website sets no cookies, runs no analytics, and loads nothing from third parties — no trackers, no CDN fonts.
• If you join the Pro & Team waitlist, we store your email address only at Mailgun (EU region) until those notifications have been sent. One email when Pro ships, one when Team is ready. No newsletter.
• The browser extension keeps all of your data on your machine. Cookies, profiles, and settings never leave your browser.
• Usage telemetry is off by default and strictly opt-in: five documented, anonymous events, hosted at PostHog EU — never URLs, domains, or cookie data (full list).
• We never sell data and share it with no one except the processors named below.

1. Controller

The controller responsible for data processing on this website and in the SessionCourier browser extension (Art. 4(7) GDPR):

FiRonDU Software UG (haftungsbeschränkt), Lillinger Weg 8, 91367 Weißenohe, Germany — email: [email protected]

2. This website

2.1 Hosting (Cloudflare Pages)

This site is a static website served by Cloudflare Pages. When you open a page, Cloudflare processes the connection data technically required to deliver it — IP address, date and time, requested URL, and browser user agent — in its server logs. We do not receive or evaluate these logs for analytics; they serve the secure and reliable operation of the site.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, reliable delivery of the website). Processor: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, bound by an EU data processing agreement; transfers to the USA are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.

2.2 No cookies, no analytics, no third-party requests

This website sets no cookies and stores nothing in your browser. It loads no fonts, scripts, images, or other resources from third-party servers, and it contains no analytics or tracking code. The only outbound request the site makes on your behalf is the waitlist form below, and only when you submit it.

2.3 Waitlist

If you join the waitlist, we process your email address for one purpose only: notifying you — once when SessionCourier Pro ships, once when Team does. (The extension itself is already on the Chrome Web Store, so there is no longer a launch notification to send.) The form's hidden "company" field is a spam trap and is discarded unread. The address is stored in a mailing list at our email processor Mailgun (Sinch), EU region, under an EU data processing agreement.

Legal basis: Art. 6(1)(a) GDPR (your consent). We keep the address until those notifications have been sent or you withdraw consent, whichever comes first. You can withdraw at any time with effect for the future — just reply to any waitlist email or write to the contact address in section 1.

3. The browser extension

3.1 Local-only by design

SessionCourier reads, edits, imports, and exports cookies entirely inside your browser. Cookie data, protected-cookie copies, settings, and preferences are stored only in your browser profile (browser.storage.local; in incognito windows, in memory only). Session recordings — which capture cookie changes including values — are held in memory only (browser.storage.session), never written to disk, and discarded when the browser closes. Exports (JSON, Netscape, curl, Playwright storageState) are written as downloads to your own disk. Nothing of this is transmitted to us or to anyone else.

The extension requests exactly five permissions at install time: cookies (read and write the cookies you are managing), storage (keep your settings and protected-cookie rules on your device), activeTab (scope the editor to the tab you are looking at), scripting (see the next paragraph), and sidePanel (show the UI in the browser's side panel). Broad website access (optional_host_permissions) is never granted at install time — it is requested at runtime, from your click, only when a feature you invoked needs it, and declining it only disables that one feature.

What scripting does, precisely. Some session state lives in a page's localStorage rather than in cookies, and unlike cookies there is no background API that can reach it — only code running in the page itself can. So the extension runs short scripts in the tab you are looking at, in an isolated world, and only when you ask it to.

It reads that one site's localStorage when you start a Playwright storageState export or a token scan; what it reads goes into the export file on your disk. It writes to that one site's localStorage when you restore a saved session into the page — only then, only after a confirmation that names the entries it will set, and only by adding or replacing those entries. It never clears or deletes storage you did not import, it checks inside the page that it really is on the site you expected before writing, it never touches another tab, and it never runs in the background.

There are no content scripts: nothing is injected into pages you are not actively exporting from or restoring into. Neither what it reads nor what it writes is transmitted to us or to anyone else.

The extension is open source with a reproducible build, so every statement on this page is verifiable in the public repository.

3.2 Optional, anonymous telemetry

On first start the extension asks once whether it may count usage. The default is off; declining is exactly as easy as accepting. If you opt in, the extension sends exactly five documented events — popup_opened, export_used (with the export format), protect_toggled, pro_teaser_clicked, and waitlist_signup — together with a random anonymous identifier generated and stored on your device. The events structurally cannot contain URLs, domains, cookie names, or cookie values; the complete event list is published at /telemetry.

Destination: PostHog EU cloud (PostHog, Inc., EU region), under an EU data processing agreement. Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw consent at any time in the extension's Settings — this stops all future events immediately. To have previously sent events deleted, email the contact address in section 1; since events are stored under a random identifier only, we will help you read that identifier from the extension's local storage so we can find and delete your events.

3.3 Chrome Web Store Limited Use

SessionCourier's use of the data it can reach is limited to providing and improving the single purpose stated on its Chrome Web Store page: managing browser cookies and per-site session state for development, QA, and test-automation work. We affirm that our use of information received through Chrome APIs, and of any information received from Google APIs, adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Concretely: we do not collect web browsing activity, we do not sell user data, we do not transfer it for advertising, credit-worthiness, or lending purposes, and we do not use it for anything unrelated to that single purpose.

4. Recipients of data

Beyond these processors, no data is shared with third parties. We do not sell personal data, and we do not use it for advertising, credit, or profiling purposes.

5. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw any consent at any time with effect for the future (Art. 7(3) GDPR);
• lodge a complaint with a supervisory authority (Art. 77 GDPR) — in Germany, the data protection authority (Landesdatenschutzbeauftragte) of your federal state, or the one competent for the controller's seat.

To exercise any of these rights, email the contact address in section 1.

6. Changes to this policy

We will update this policy when the site or the extension change in ways that affect data processing — for example when accounts and end-to-end-encrypted sync ship (the server will then store ciphertext it cannot read). The current version is always on this page.

A changed page is not on its own enough, so we commit to more than that: if our data handling changes after you have already installed the extension, we will tell you in the extension itself before the change takes effect for you, and any new data collection will be off until you actively agree to it — the same opt-in choice, equally easy to decline, that you were given for telemetry. Silently starting to collect something new under a quietly updated policy is not something we will do.