Last updated: August 20, 2026

Canary Trap is a browser extension that generates a unique, per-site email alias (e.g. you+company@gmail.com) so you can tell which companies leak, sell, or misuse your email address. This policy explains what data the extension collects, how it's stored, and how it's used.

What data is collected
Your base email address — the address (local part + domain) you enter in Settings, used to build every per-site alias.
Tracked sites log — for each site where you've used an alias: the site's hostname, the alias generated for it, how many times it's been used, and when it was first/last used.
Canary Trap does not collect passwords, page content, browsing history beyond the hostnames listed above, or any data unrelated to generating and tracking email aliases.

How your data is stored
All data is stored locally on your device using the browser's chrome.storage.local API. It is not synced to your Google/browser account, not transmitted to any server, and Canary Trap does not operate or rely on any backend of its own — there is nothing to send it to. Nothing loaded or run by the extension comes from a remote server; the extension (including its font) is entirely self-contained.

How your data is used
Your base email address is used only to build the per-site alias shown in the popup and inserted into email fields.
The tracked-sites log is shown to you in the popup so you can see which alias was used where, and export it as a CSV for your own records.
Canary Trap does not sell, rent, or share your data with any third party, does not use it for advertising or analytics, and does not use it to make credit or lending decisions.

Your controls
Clear log: the Settings page has a button to permanently delete the tracked-sites log.
Uninstall: removing the extension deletes all locally stored data (your base email settings and the tracked-sites log) along with it.
Permissions
Canary Trap requests broad host access (<all_urls>) so its content script can detect focused email fields on any site you sign up on — this access is used only to read the type of the currently focused input and fill in the generated alias; it is not used to read, log, or transmit other page content. Other permissions (storage, contextMenus, scripting, clipboardWrite, downloads) support the settings/log storage, the right-click "copy alias" menu item, the popup's Copy button, and the CSV export feature respectively.

Changes to this policy
If this policy changes, the "Last updated" date above will be revised and the change will be reflected in this file's commit history.

Contact
Questions about this policy or the extension can be raised via GitHub Issues.