Browser Extension Privacy Policy

Last updated 11 August 2026 · Applies to the Ryzlo browser extension

In short

The extension does one thing: it mirrors a focus session you started on your phone, and redirects the websites you chose to block while that session runs.

It has no account of its own and never asks you to sign in. It does not read, log, or transmit your browsing history, and it contains no analytics, no advertising, and no third-party trackers.

What the extension collects

This is the complete list. Nothing else leaves your browser.

Nothing is collected until you choose to link. The extension popup states what linking shares before you do it, and linking — typing your pairing code, or scanning the QR code — is your affirmative consent. You can withdraw it at any time by disconnecting, which deletes the data as described below.

What the extension does not collect

• Your browsing history. The extension requests no tabs, history, or scripting permission and injects no scripts into web pages, so it has no technical means to see where you go. Blocking is performed by Chrome's built-in declarativeNetRequest engine, which matches your block list against requests inside your own browser. The addresses you visit are never read by us, never logged, and never transmitted.
• Page content — text, images, form fields, passwords, keystrokes, clicks or scrolling.
• Your name, email address or password. The extension holds no account credentials and never signs in to anything.
• Location, contacts, health, financial or payment information.
• Advertising or analytics identifiers. There is no analytics SDK, no advertising SDK, and no third-party code of any kind in the extension.

Why the extension asks for access to all websites

Chrome grants an extension permission to redirect a request only if that extension holds host access. Without it, Chrome silently ignores our redirect rules and your block list stops working.

We use that access for exactly one purpose: when you navigate to a site on your own block list during a session, we send that tab to the Ryzlo block screen instead. The access is never used to read a page, and the domains are the ones you picked on your phone — we never add to them.

How your data is used and handled

The data above is used only to link your browser to your phone, to show you the state of the session you started, and to apply the block list you chose. Nothing else. All handling happens inside the extension and on Ryzlo's own backend — no third-party service ever processes it apart from the hosting provider listed below.

Specifically, we do not:

• sell or transfer your data to third parties, for money or otherwise;
• use or transfer it for any purpose unrelated to the single purpose described above;
• use or transfer it to determine creditworthiness, or for lending purposes;
• use it for advertising, profiling, or cross-site tracking.

How and where your data is stored

On your own computer

The extension keeps three entries in your browser's local extension storage. They stay on your machine and are never synced to your Google account:

• focus_browser_device — this browser's device id, its device token, and the name of the realtime channel it listens on;
• focus_extension_state — the current session, so the popup can render instantly;
• ryzlo_qr_pair_request — a pending QR pairing request, removed as soon as pairing completes, is cancelled, or expires.

On our backend

Ryzlo's backend runs on Supabase, which provides our database and serverless functions. It holds a record of each linked browser (its label, user-agent, and creation time) and your currently active session, so the extension can pick it up.

Your device token is stored only as a SHA-256 hash. The raw token is returned to your browser once, at the moment of pairing, and is never written to our database — so it cannot be read back out of it, by us or by anyone else. Pairing codes are stored the same way, and expire within minutes.

Traffic between the extension and the backend is encrypted in transit over HTTPS and secure WebSockets.

Who we share it with

One provider, acting on our instructions:

That is the entire list. No advertisers, no data brokers, no analytics companies, no other third parties receive anything. We disclose data otherwise only where the law requires it of us.

How long we keep it, and how to delete it

• Disconnect in the extension popup. This deletes this browser's device record from our backend and erases everything the extension stored locally. It takes effect immediately.
• Unlink from your phone, under Profile → Browser. The same record is deleted; the extension notices at its next sync and clears its local storage too.
• Uninstall the extension. Your browser removes all local extension storage. If you uninstall without disconnecting first, the device record stays on our backend until you remove it from your phone or delete your account.
• Delete your Ryzlo account, from the app. This removes all of your device and pairing records along with the rest of your account data.

Session data is transient by nature: it is replaced at each sync and cleared when the session ends. Expired pairing requests are discarded automatically.

Your rights

Under the UK GDPR and EU GDPR you can ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format.

Email ryzloapp@gmail.com. We'll get back to you as quickly as we can, and within one month at the latest. If you think we've got it wrong, you can complain to the UK's Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

Children

Ryzlo is not directed at children under 13, and we do not knowingly collect data from them.

Changes to this policy

If we change what the extension collects or how we handle it, we will update this page and change the date at the top before the change ships.

Contact

Ryzlo is the data controller for the data described here.

Data protection contact: ryzloapp@gmail.com