Let's GPC Privacy Policy

Effective date: August 11, 2026 · Last updated: August 11, 2026

Short version: Let's GPC has no developer-operated server, telemetry, analytics, advertising, or remote code. It stores a limited domain list and extension settings locally in Chrome. Nothing is uploaded to the developer.

1. Scope and single purpose

This policy applies to the Let's GPC Chrome extension. Its single purpose is to let users express and manage browser-level opt-out privacy preferences by sending Global Privacy Control (GPC), exposing the corresponding page property where Chrome permits it, supporting explicit top-level site exceptions, and optionally disabling Chrome Topics.

2. Data handled on your device

To provide its visible domain list and site exceptions, the extension stores the following information in chrome.storage.local on your device:

• extension settings, including whether GPC and Topics protection are enabled, the selected theme, and site exceptions;
• hostnames of top-level websites visited after installation;
• hostnames of resources already visible through the current page's Resource Timing entries, read only when you open the popup;
• a last-seen timestamp and simple flags identifying whether a hostname was observed as a page or resource.

For Chrome Web Store disclosure purposes, these locally stored hostnames and timestamps are treated as Web history. The extension does not store full URLs, paths, query strings, page text, form data, cookies, passwords, authentication data, personal communications, financial data, health data, or personal identifiers. Automatic domain-history recording is skipped in incognito windows.

3. No collection by the developer

The developer does not receive, collect, sell, rent, share, or transfer the locally stored information. The extension has no developer-operated backend, account system, telemetry, crash reporting, analytics, advertising, tracking pixels, or remote configuration.

4. Network behavior

• When protection is enabled, Chrome adds Sec-GPC: 1 to covered HTTP, HTTPS, and WebSocket requests. This is the extension's user-facing privacy signal.
• When you open the popup, the extension may request /.well-known/gpc.json from the current website to check its public GPC support declaration. Credentials are omitted, redirects are rejected, and the response is not sent to the developer.
• These requests go directly from your browser to the relevant website. The extension does not upload its stored domain list or settings with them.

All executable code is included in the submitted extension package. The extension does not download or execute remote JavaScript, WebAssembly, modules, or configuration.

5. Retention and user control

The local domain list is capped at 5,000 unique domains. When the cap is reached, the oldest non-exception records may be removed. You can search, export, import, forget individual domains, or clear all domain records and site exceptions from the extension's settings page. Removing the extension also removes its Chrome-managed local extension storage.

6. Permission use

• Host access lets the universal GPC signal apply across websites and supported WebSocket requests.
• declarativeNetRequestWithHostAccess lets Chrome apply one declarative Sec-GPC rule without per-request extension JavaScript.
• privacy is used only to read, set, or clear Chrome's Topics setting.
• scripting registers the packaged page-property script and reads existing Resource Timing hostnames on demand.
• storage stores settings, exceptions, and the local domain list on the device.

7. Limited Use

Let's GPC's use of information received from Chrome extension APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Information is used only to provide the extension's disclosed user-facing functionality and is never used for advertising, profiling, creditworthiness, lending, or unrelated purposes.

8. Policy changes

If the extension's data practices change, this page and the Chrome Web Store disclosures will be updated before the changed behavior is released. The effective date above will also be revised.

9. Contact

Questions or privacy requests can be submitted through the project's GitHub issue tracker. The extension's source code is available in the Let's GPC repository.