PinchaHide by Pinchavelho – Privacy Policy
What PinchaHide can access, every network connection it makes and how to check it yourself: transparency report.
Controller: José Augusto Alves Pinhão, trading as "Pinchavelho", Estrada V Centenario Vila Sol I, Bloco B 3CE, 9360-500 Ponta do Sol, Portugal (other trader details in the legal notice: https://pinchavelho.github.io/legal-notice.html). Email: opinchavelho@gmail.com.
1. What the extension does NOT do
PinchaHide does not collect, sell or share your browsing history, the pages you visit, what you type or what pages show. No analytics, no ads, no tracking, no remote code. PinchaHide focuses on consent and privacy: it refuses cookie banners and, with Pro, blocks tracking.
Why PinchaHide asks for access to all websites: cookie banners appear on any site, so PinchaHide needs to run on every page to find the banner and press "Reject" (or hide it when there is no way to refuse, without ever accepting). On each page it looks only at the consent banner and, with Pro, at newsletter or "install the app" boxes and at the address you copy. It reads the site's consent record (IAB TCF) only to count, in the popup, how many purposes are still on. None of this leaves your browser.
Blocking trackers and removing tracking parameters (Pro) is done by Chrome itself with rules bundled in the extension (declarativeNetRequest): PinchaHide does not see the requests.
Clean Links (Pro) never reads your clipboard: when you copy a web address inside a page, or use "Copy clean link", PinchaHide replaces only the text being copied with the same address without tracking parameters. It never opens the link to find out where it leads.
2. Data stored on your device/browser
- Settings (what is on or off, sites with protection off, per-site exceptions, sites whose cookies to keep): chrome.storage.local, on your device. Change them in Options; uninstalling deletes them.
- Counts: numbers per day and per consent platform (e.g. "OneTrust: 12"), without sites: chrome.storage.local. Uninstalling deletes them.
- History (Pro, can be turned off): for the last 30 days, the site's domain, date and result (refused, hidden, pop-up closed), up to 3,000 lines: chrome.storage.local. Delete it in Options ("Delete history") or by turning it off.
- Reports you prepare yourself on the "Report a site" page: stored on your device; nothing is sent unless you choose to copy the text or open your own email app.
- What was done on each open tab (the tab's site and what PinchaHide did): chrome.storage.session, in memory only, deleted when the tab or the browser closes.
- Installation date (to run the free trial locally) and, only if you enter one, your Polar licence key, its activation ID/label and the last check result: chrome.storage.local, on your device (not synced). "Remove key" in Options deletes the key.
- The interface language you pick in Options (only if you change it from "automatic"): the extension's own local storage (localStorage) in PinchaHide's pages, on your device. Uninstalling deletes it.
This storage is strictly necessary for the features you request (ePrivacy Directive art. 5(3)).
Optional Chrome permissions are asked only when you turn on the feature that needs them: "privacy" (Chrome privacy settings: third-party cookies, ad APIs, Do Not Track, WebRTC) and "cookies" (clearing a site's cookies when you close its last tab). PinchaHide deletes cookies only; it never reads their content for any other purpose.
3. Purchases, licence keys and trial
The 15-day trial (all Pro features) runs locally (installation date on your device); no sign-up and no data is sent.
Purchases are made on the checkout of Polar (Polar Software Inc., polar.sh), which acts as merchant of record: Polar is the seller of record, processes the payment (through its payment providers such as Stripe), charges and remits VAT/sales tax and issues the invoice/receipt. Polar collects your email address, billing country/address and payment details under its own privacy policy (https://polar.sh/legal/privacy) and makes the licence key available in its customer portal. We receive from Polar your email address, name if given, country, order date, amount and licence-key status – we never see your card details.
- What the extension sends to Polar: only when you enter a key, the key, our organisation ID and a random activation label (e.g. "PinchaHide 3fa9c21b") to https://api.polar.sh, to activate it and re-check it about once a day (an offline grace period applies). No browsing data or addresses are sent. This is the extension's only network connection of its own.
- Links you open yourself: "Continue to secure payment (Polar)" opens Polar's checkout page (buy.polar.sh) in a new tab, and the extension links to this policy online (pinchavelho.github.io). These pages are opened by you; the extension itself sends nothing to them.
- Like any internet request, these licence checks reveal your IP address and browser user agent to Polar, which processes them under its own privacy policy. The extension sends the requests without cookies.
- Withdrawal waiver: Polar's checkout asks you to tick the box "I want immediate access and I accept that I lose my 14-day right of withdrawal." Polar keeps that consent with your order and confirms it in the purchase email; we may receive it from Polar as proof of compliance (GDPR art. 6(1)(c)).
- Purposes and legal bases: providing the licence and support (contract, GDPR art. 6(1)(b)); accounting and legal obligations (art. 6(1)(c)).
- Recipients: Polar Software Inc. (merchant of record; USA – transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses, see Polar's policy) and its payment providers; our accountant and the tax authorities where required.
- Retention: licence data while your licence is active plus 2 years; accounting records as required by law (Portugal: 10 years).
4. Your rights
Access, rectification, erasure, restriction, objection and portability (GDPR arts. 15–21): write to opinchavelho@gmail.com. You may complain to the Portuguese supervisory authority, CNPD (www.cnpd.pt) or your local authority.
5. Children
PinchaHide is not directed to children under 13; purchases require being of legal age or parental consent.
6. California and other US residents
Under the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws: in the last 12 months we collected, only from buyers, identifiers (email address, name if given) and commercial information (order date, amount, country, licence status), received from Polar, for the business purposes of providing the licence, support and complying with law. We do not collect sensitive personal information.
We do not sell or share personal information (including for cross-context behavioural advertising), and we have no actual knowledge of selling or sharing data of consumers under 16.
You may ask to know, access, correct or delete your personal information by emailing opinchavelho@gmail.com. We will verify the request by matching the email used for the purchase. An authorised agent may act for you with your signed permission. We will not discriminate against you for exercising these rights.
7. This website
This website (pinchavelho.github.io) sets no cookies, uses no analytics or trackers and loads no third-party resources; fonts are self-hosted. It is hosted by GitHub Pages (GitHub, Inc., USA), which may log visitors' IP addresses for security and service operation, under GitHub's privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
8. Changes
We will update this page and the date above; material changes will be shown in the extension.