Extension Privacy Policy

Last updated: 10 November 2026

Covers the GTM QA Toolbox browser extension specifically. For CookieChest's wider services see the main Privacy Policy.

What the extension does

The extension checks whether tag tracking (GTM, GA4, Consent Mode v2, your CMP) is actually working on whatever page you currently have open, including staging and logged-in pages a server-side scanner can never reach. Everything it checks runs inside your own browser, on the page you're already viewing.

Why it asks for broad site access

The extension requests permission to run on any page (<all_urls>) for two reasons, both required for it to function at all:

• You could be checking any client's site, and the extension has no way to know in advance which pages you'll want to check, so it can't be limited to a fixed list of domains.
• Detecting whether a tag actually fired means watching outbound network requests to third-party tracker domains (google-analytics.com, facebook.com, and similar). Those requests never share an origin with the page itself, so a narrower permission couldn't see them.

What stays on your device

The following never leaves your browser: page content, GTM container IDs, consent banner state, cookie names and values, and the network-request log shown in the Tag Activity tab. All of it is read, matched against known tracker patterns, and displayed locally. CookieChest's servers never receive it, except in a report you choose to send (below).

The Cookie Report tab reads real cookies from your browser (via the cookies permission, including ones a server-side scanner can't see) to build a privacy-policy-ready breakdown. A cookie's value is never sent anywhere; only its name is ever transmitted, and only when you submit a description (below).

What does leave your browser

• Vendor pattern list & cookie reference table: on install and periodically after, the extension fetches public, read-only reference data from our server: tracker-detection patterns, and a cookie name/description/duration/category table (seeded from the open-source Open Cookie Database, plus community contributions, see below). Nothing about you or the page you're on is sent with this request.
• Cookie description contributions: if a cookie on the page isn't in the reference table and you choose to submit a description for it (or verify/edit someone else's submission), the cookie's name and the text you write are sent to our server so other users checking the same cookie benefit from it. Unverified community submissions are clearly flagged as such in the app and in any CSV export, until enough independent users confirm them.
• Optional account: if you sign up, your email address is sent to our server to create an account and verify it. The extension then holds an account key, which it sends to our server to check your credit balance and scan allowance. An account is never required for the extension's free checks.
• Buying credits: payments are handled by Stripe, our payment processor. Card details go to Stripe on its checkout page and never reach us or the extension.
• Headless cookie scan: if you start a paid cookie scan, the address of the page and your account key are sent to our server. Our server loads that page in a fresh browser and returns the cookies it finds. This only happens when you start a scan.
• Unrecognised consent banner reports: if the extension doesn't recognise a site's consent banner and you click "Report this page", we receive the page address (without any query string), the extension version, the name of the banner provider if detected, and a redacted summary of the check results. No email or account details are sent.
• Feedback reports: if you use the "Report an issue" button, the message you write, your contact email, the address of the page you were checking (without any query string or anything after a #), the extension version, and your last health-check result are sent to us so we can investigate and follow up with you. This only happens when you actively submit a report.
• Anonymous usage counts: the extension reports that certain things happened (for example a check was run, or a scan was used) so we know the tool is being used and where to improve it. These events carry only the event name and a random per-install ID, not tied to your identity and not stored once received. They never include the page address, domain, or any cookie or tracker data. They are on by default; you can switch them off in the extension's About tab. We intentionally don't want to know which sites you're checking, only that the tool is useful.

What we do with it

Account details, scan requests and feedback reports are used only to provide the extension's features and respond to reports, never sold, never shared with third parties (other than Stripe for payments), and never used for advertising. Feedback reports are retained for as long as useful for fixing the issue reported; you can ask us to delete yours at any time.

Contact

Questions about this policy, or want your data deleted? Use our contact form.