RankShield Browser Guardian never transmits your passwords, cookies, authentication tokens, page content, form inputs, full URLs, or browsing history. We never sell user data and never use it for advertising. The only data that leaves your browser is the de-identified threat signal described below.
To detect threats, the extension reads two things locally on your device only: (1) your signed-in Google account identifier (email/ID via chrome.identity) — used solely to notice if the account signed into this profile changes (an account-takeover signal); and (2) the visible permission/security text shown on Google's own consent and security pages (accounts.google.com / myaccount.google.com) — used to warn you about high-risk grants. Neither is stored off-device or transmitted; only the de-identified fingerprint below is ever shared.
To power the federated threat network that protects all users, the extension may send de-identified threat signals: a salted, one-way SHA-256 fingerprint of a threat indicator (for example, the ID of an extension our risk engine flagged, or the set of high-risk OAuth scopes a consent screen requested), plus a category and severity. These fingerprints are one-way and cannot be reversed to reveal you, the website, the account, or the original value.
Settings, the cached threat blocklist, and your local extension-audit results live only in your browser's extension storage. They are never uploaded.
The extension uses the minimum permissions needed to warn you about risky extensions, high-risk Google-account
consent requests, and known-malicious sites. The accounts.google.com content script reads only the
visible scope text already shown on a consent page — never passwords, cookies, or tokens.
All executable code is bundled in the extension and reviewed by the Chrome Web Store. We fetch threat data only — never executable code.
Some threats — operating-system-level cookie/infostealer theft, and traffic we are not permitted to inspect under Manifest V3 — can only be flagged, or are outside an extension's reach entirely. We tell you what we can detect, warn on, and block, and we do not overstate it.