Extension

Privacy policy

This covers the CrawlCheck browser extension. Every claim below is checkable by reading the source, and each one says which version it applies to.

What reaches crawlcheck.io, from version 1.0.0

• The domain you ask about, when you press “Two vantages”. The extension sends the site’s domain to GET /api/flow to fetch CrawlCheck’s edge reading of it, then compares that reading with what your own connection receives. Only on that button; never in the background. No page content, no path, no cookies.
• Anonymous usage counts, to POST /api/ext/event: the event name (installed, updated, popup opened, a tool pressed, a verdict’s class counts), the extension version, a random install id created on your device, and small counters. Never a URL, a domain, page content, a licence key or anything typed. The server refuses any field that could carry one, and stores daily totals only. Switch it off with the checkbox in the popup footer; the choice is honoured at once.
• Your licence key, if you enter one: GET /api/licence/check, at most once every 24 hours, with the key and nothing else.
• A Data Axle listing page, in versions 1.0.1 to 1.0.7 only (removed in 1.0.8, 11 October 2026; 1.0.8 and later make no request to Data Axle), only when you pressed “Data Axle listing” and had saved a licence key. What those versions did: the extension reads the phone number the current page declares, fetches Data Axle’s public search page for that number from your browser, and posts that search page and the site’s domain to POST /api/nap/observe, so the site’s CrawlCheck report can show whether the business is listed. The server accepts it only for a domain on your licence. Without a saved key the answer is shown in the popup and nothing is sent.
• A listing form fill, in version 1.0.7 and from version 1.0.9 (1.0.8 does not have it), only when you press “Fill listing form” with a saved licence key. The values already in the form are read only to compare them with your record; they are shown to you in the popup and never sent. the extension asks GET /api/v1/business/submit-kit for your business’s own record (name, phone, website, address or service area, from your site and linked Business Profile) and types it into the add or claim form open in your tab. Nothing is read from that page and sent anywhere, the form is never submitted by the extension, and contact names, email, passwords and captchas are never touched. Only if you then press “I submitted it” does the extension send POST /api/v1/business/submissions: your domain, which directory, that page’s hostname and the names of the fields it filled (never their values), so CrawlCheck can check the directory at its next daily reading.

Versions up to 0.9.1 sent none of the first two: they made only the licence check.

The agent view and the registry, from version 1.0.8

The domain of the site in your active tab, to GET /api/v1/resolve, only when you open the Agent view tab, so it can show what CrawlCheck tells an AI agent about that site. The domain only: never the path, the page, a cookie or anything typed. The extension also reads CrawlCheck’s public key directory (/.well-known/http-message-signatures-directory) to check the answer’s signature in your browser. If you press a draft button there, the domain goes to /api/tool/llms, /api/fix/robots or /api/fix/entitymap to draft that file. Join the registry opens crawlcheck.io/registry/<domain>/claim in a new tab; the extension itself sends nothing.

Grades as you browse, from version 1.0.3

The hostname of the page in your active tab, to GET /api/extension/site, so the toolbar icon can show that site’s grade if it has ever been measured. Hostname only — never the path, the page, a query string, a cookie or anything typed. The answer is the same public record a report shows. It is on by default and is stated on first run; the switch to turn it off is in the popup footer and is honoured at once. Sites you add to your watch list are looked up the same way, in one request of up to 25 hostnames, when you open the popup. The server does not store which hostnames were asked about.

What stays on your device

Signed Two-vantages readings, from version 1.0.4

When you press Two vantages with sharing switched on, the reading from your connection goes to POST /api/vantage/observe: the hostname, the page address that was measured, and for each identity the HTTP status, byte count, visible word count, a hash of the body and the verdict class. Never the page content, cookies, anything typed or your licence key. Your connection is recorded as country and network name only; the address is never stored. Each install signs its readings with its own key, made on first use and kept in your browser, so a reading can be shown to come unaltered from one install; the key does not identify you. The site’s report then shows your network beside CrawlCheck’s. Sharing is on by default and the switch to turn it off is in the popup footer.

• Measurements you run, held in the browser’s local and session storage. Apart from a shared Two-vantages reading (above), they are never sent anywhere, and you can clear them by removing the extension.
• Your licence key, if you have one, the random install id, and your usage-count choice.
• The last run, so the popup reopens where you left it.

Requests to sites you measure

When you measure a page, the extension requests it as each named crawler and as your browser. Those requests are sent with credentials: "omit", so your cookies, sessions and logins are never attached. The extension identifies itself honestly and does not impersonate an operator’s crawler to obtain access it would not otherwise be given.

Sharing and sale

Nothing is shared with, sold or transferred to third parties; the usage counts stay at crawlcheck.io. Nothing is used for advertising, creditworthiness or lending, or to train anything. There is no remote code and no advertising network.

Permissions, and the feature each one exists for

• declarativeNetRequest — a request cannot set its own User-Agent from a page, so a session rule is the only supported way to ask for a page as a named crawler. One rule exists at a time and it is removed in a finally block.
• scripting and activeTab — read timings and the rendered DOM of the tab you are looking at, when you ask. It reads and returns; it writes nothing to the page.
• tabs — read the active tab’s address so the popup measures the site you are on, and clear a tab’s saved check when it navigates away or closes.
• storage — the local items listed above.
• contextMenus — one right-click item.
• alarms — re-read the watch list every six hours, so the toolbar dot shows when a watched site’s grade moves.
• Host access to all sites — you choose which site to measure and it is not a site we can predict. That choice is the entire function.

Support

For help with the extension, a bug report or a question, email hello@crawlcheck.io. What each tool measures and how to use it is on the extension page.

Changes and contact

Material changes are published on this page with the date they took effect. Questions: hello@crawlcheck.io.

Last updated 11 October 2026 (1.0.9: Fill listing form, as in 1.0.7; 1.0.8: the agent view and Join the registry, Data Axle check removed; 1.0.1: the Data Axle listing check; 1.0.0: Two vantages and anonymous usage counts). The extension currently published is version 1.0.8.