Privacy & Data
How the extension handles your data — audits run locally, no signup, no tracking, and API keys are stored encrypted on your device.
The extension runs entirely on your device. Core audits are local, there is no account to create, and Digispot does not receive any data about what you audit unless you explicitly opt into a feature that requires it.
Audits run locally
When you audit a page, the extension reads the live page in your browser. It runs all 150+ checks on your machine. Digispot does not collect, store, or transmit your audit results, API keys, browsing activity, or which pages you audit. The analysis never leaves the browser session.
No account or signup required
The core extension works with no signup, no email, and no credit card. Install from the Chrome Web Store and audit any page immediately. Creating a Digispot account is optional. It unlocks managed AI and premium server-side lookups, but none of those fire unless you actively connect a key.
How API keys are stored
If you connect an AI provider (BYOK) or a PageSpeed API key, those keys are
stored in Chrome's encrypted browser storage. This uses chrome.storage.sync
with AES-GCM encryption, falling back to chrome.storage.local on overflow. The
keys never reach Digispot's servers. When you make an AI request, it goes directly
from your browser to the provider you chose — OpenAI, Anthropic, Google, or
DeepSeek. It does not pass through any Digispot infrastructure.
API keys are credentials tied to your billing account. Do not paste them on shared machines. If a key is exposed, rotate it immediately in your provider's dashboard. The extension has no record of it to revoke.
Permissions the extension uses
| Permission | Why it's needed |
|---|---|
activeTab | Read the current page's DOM to run checks — only fires when you click the icon |
scripting | Inject overlay badges and apply live heading edits |
storage | Save your settings, API keys, and cached results locally |
contextMenus | Add the right-click "Open in Fullscreen" entry |
An optional broad host permission (https://*/*) is requested lazily. It only
fires when a feature that needs full-page access runs for the first time on a given
site: Fullscreen mode, Live CWV, or heading Apply. It is never requested in
Popup mode. You can deny it without losing any other functionality.
When data does leave your device
Everything is opt-in. Three scenarios involve requests leaving the browser:
| Scenario | Where the request goes | Opt-in required |
|---|---|---|
| BYOK AI audit or chat | Directly to your AI provider (OpenAI / Anthropic / Google / DeepSeek) | Connect an API key in Config → AI Provider |
| Managed AI via Extension Key | Through your Digispot account | Connect an ext_… key in Config → Account |
| CrUX, PageSpeed, or Domain Age lookups | Through your Digispot account | Extension Key required; lookups are on-demand, not automatic |
All on-page SEO checks run entirely on your device, with none of the above. This covers every panel in the extension.