Privacy Policy
Last updated 17 August 2026
LeadScout is a Chrome extension and web app that helps freelancers find businesses that may need their services. This policy describes exactly what it reads, what leaves your browser, what is stored, and how to delete it.
It is written against what the software actually does. If you find a discrepancy, treat it as a bug and tell us.
- We do not collect your browsing history.
- We read no page except a Google search results page you are already viewing.
- Nothing about a business is sent to our server unless you click Analyze or Save.
- We do not sell data, and we run no advertising or third-party analytics trackers.
- You can delete everything from Settings → Delete my data.
What the extension reads in your browser
The extension runs on Google search result pages only — google.com/search and
the country equivalents listed in its manifest. It has no access to any other website you
visit.
On those pages it reads what is already displayed: business names, links, snippets, and any
star rating or review count Google rendered. This happens locally in your browser. Results
are held in chrome.storage.session, which Chrome clears when the tab closes or
the browser exits.
The extension requests only the sidePanel and storage permissions,
plus network access to our own API domain. It does not request access to all websites.
What is sent to our server
Nothing is transmitted until you act.
When you click Analyze
We send the business's website address, its name, and any rating or review count shown on
the results page. Our server then requests that business's public homepage — the same page
anyone can visit — and records structured facts about it: whether it uses HTTPS, whether it
declares a mobile viewport, whether it has a booking link, page title length, and similar.
We do not store the page's full HTML. We check the site's robots.txt first and
do not fetch it if crawling is disallowed.
When you click Save
We store the business name, domain, address, the rating and review count shown on the results page, and the search query the lead came from.
When you draft outreach
The structured observations from the analysis — not the web page, and not your browsing data — are sent to Cloudflare Workers AI to be phrased into a message.
When you create an account
We store your email address and a cryptographic hash of your password. We never store your password itself and cannot recover it.
What we store
| Data | Why | Retention |
|---|---|---|
| A random installation ID | Identifies your account without requiring signup | Until you delete your data |
| Email address and password hash | Signing in from the web app | Until you delete your data |
| Session tokens (hashed) | Keeps you signed in | 30 days, then deleted |
| Saved leads and notes | Your pipeline | Until you delete them |
| Service profile and your prices | Weights findings; calculates project value | Until you delete your data |
| Usage counts | Enforces plan limits | Rolling monthly counters |
| Subscription status and Lemon Squeezy IDs | Grants the plan you paid for | Life of the subscription |
| Website analyses | Avoids re-fetching the same public site | 7 days, then re-fetched |
| Password reset tokens (hashed) | Lets you regain access | 1 hour, single use |
| A salted hash of your IP address | Rate-limits account creation | Deleted after 1 hour |
Your IP address is never stored in readable form. Only a salted SHA-256 hash is kept, and only for one hour, to stop automated abuse of the signup endpoint.
Website analyses are cached against the website's address, not against you, and are shared between users. They contain only facts about a public website.
Stored only in your browser
Businesses you Skip are remembered in your browser's local storage and are never sent to our server. Skipping is a judgement about your own time, not data about the business.
What we never collect
- Browsing history, or any list of sites you have visited
- The content of pages other than the Google results page you are viewing
- Keystrokes, form contents, passwords or cookies from sites you visit
- Personal data about the customers of the businesses you research
Third parties
- Cloudflare hosts our API, database and AI models. Data is processed on Cloudflare's network. Cloudflare's documentation states that inputs to Workers AI are not used to train its models.
- Lemon Squeezy processes payments if you subscribe. They receive your email and payment details directly; we never see your card details. They send us your subscription status and the email you checked out with.
- Our email provider delivers account emails such as password resets, and receives your email address for that purpose only.
We do not sell data, and we do not run advertising or third-party analytics trackers.
Limited use
Our use of information received from Google APIs and from pages you view adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the features described here, is never sold, and is never used for advertising or profiling.
Your control
- Delete a lead — Saved tab → Remove, or Leads → Remove in the web app.
- Delete everything — Settings → Delete my data. This erases your account, saved leads, notes, service profile, usage records and subscription record. It cannot be undone. Cached analyses of public websites are not deleted, because they contain nothing about you.
- Stop all data collection — uninstall the extension.
Businesses you research
LeadScout reads publicly available information about businesses — their public website and what Google displays about them. If a business asks you to delete information you have stored about them, remove the lead from your Saved list, or contact us and we will remove it.
Children
LeadScout is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.
Contact
Questions or deletion requests: neetpav46@gmail.com
Changes
If this policy changes materially, the extension will show the change before continuing to send data under the new terms.