Privacy notice

You upload a single file: your Chrome extension's manifest.json. The page does not ask you to upload your source code, icons, screenshots, or packaged .zip.

The free risk scan is computed entirely in your browser. The static rule engine that produces the risk score, finding list, and derived facts (effective host access, declared permissions, remote endpoints, sensitive APIs) executes as JavaScript on the page you loaded — your manifest does not leave your computer for this step.

When you click Generate Launch Kit, the page POSTs your manifest.json contents to /api/generate on the ReviewArmor Cloudflare Worker. This is required to run the document-generation step on the server side.

When you click Download ZIP, the page POSTs your manifest and the already-generated document text to /api/generate-zip to build the archive on the server side.

ReviewArmor uses DeepSeek (deepseek-chat) to draft the five launch documents. To generate each document, the server sends a prompt to DeepSeek that includes:

• Your manifest's derived facts (permissions, host patterns, content scripts, sensitive capabilities, remote endpoints).
• The list of risk findings produced by the local scanner.
• A fixed system prompt describing Chrome Web Store policy and ReviewArmor's drafting rules.

DeepSeek's privacy and data-handling practices are governed by DeepSeek's own terms. We do not control what DeepSeek does with this prompt content beyond what its terms specify.

ReviewArmor does not persist your uploaded manifest, generated documents, or prompt content to any database, object store, or log file. Each request is processed in-memory in the Cloudflare Worker and discarded when the response is returned. We do not assign you a user ID, cookie, or session token, and we do not require sign-up.

The Cloudflare Worker emits standard request-level metrics (request count, response status, latency) via Cloudflare Observability. These metrics do not include your manifest content. We do not enable Workers Logpush, do not export request bodies, and do not attach analytics, error-tracking, or fingerprinting scripts to the frontend.

Cloudflare itself may retain edge-level diagnostic data per its own policies; see the Cloudflare Privacy Policy.

Questions about this notice, deletion requests, or security reports: onebluecloud@outlook.com.