Privacy policy
Last updated August 26, 2026.
ExtensionDash tracks how Chrome and Firefox extensions perform in their stores. This page describes exactly what it stores about you, who else sees it, and how to get rid of it. It describes what the software does today; where behaviour changes, this page changes with it.
What is collected
Your account. An email address, always. If you signed up
with an email address and a password, a bcrypt hash of that password — never
the password itself. If you signed in with Google, the account identifier
Google issues for you (its sub claim) instead of any password.
Your sessions. Each time you sign in, the IP address and browser user-agent string of that sign-in, so an active session can be told from an old one.
What you ask it to track. The extensions, search terms, store languages and competitors you add, and the measurements taken against them over time — install counts, ratings, store search positions and listing copy. This is public store data; it is stored against your account because you chose to watch it.
Feedback you send. If you use the feedback button, the message and the page you were on when you wrote it.
An API token, generated for you, which lets an agent read your dashboard over the Model Context Protocol. You can rotate it at any time from your profile.
What is not collected
No payment details — the service takes no payments. Nothing from your
Google account beyond the email address and account identifier; the sign-in
requests the email scope and nothing else, so your name, profile
picture, contacts, calendar and files are never sent to this app and could not
be read if they were. No tracking of you across other websites.
Who else sees it
Google, if you choose to sign in with Google. That exchange is between you and Google; this app receives only the address and identifier described above.
Google Analytics runs on the public pages of this site — the marketing page, sign-in and signup — and is used to count visits. It does not run on any page behind the login, so nothing you track is measured. It is active only on the live site.
A push notification service (ntfy) receives a message when somebody signs up or sends feedback, so the operator learns about it promptly. That message contains the email address of the account, and for feedback also the page and the text of the message.
An email delivery provider (ForwardEmail) handles the one kind of email this app sends: a password reset you asked for. It sees the address the message goes to.
Beyond those, nothing is sold, rented, or handed to advertisers. Data is disclosed otherwise only where the law requires it.
Where it is kept
On servers rented from DigitalOcean, in the European Union. Traffic to and from this site is encrypted in transit.
Keeping and deleting it
Your account and its data are kept for as long as the account exists. Stop tracking an extension and its recorded history is kept, so that re-adding it later restores the charts — that is deliberate, and it means "stop tracking" is not the same as "delete".
To delete your account and everything attached to it — sessions, tracked extensions, recorded measurements, feedback — email support@extensiondash.com from the address on the account. You can also ask for a copy of what is held about you, or for a correction. There is no charge, and no dark pattern in the way.
Cookies
One cookie holds your signed-in session. It is required for the site to work at all and is not used for advertising. Google Analytics sets its own cookies on the public pages described above.
Changes
If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and account holders are told by email.