Privacy policy

Effective 18 May 2026

Kosher Browser is a local Chrome extension that helps users block distracting or inappropriate websites with schedules, a focus timer, password protection, strict mode, and SafeSearch enforcement. This page explains, in plain English, exactly what data the extension touches.

What we collect

Nothing. Kosher Browser collects no personal data, no analytics, no telemetry, and no crash reports. There is no account system because there is nothing to associate to an account.

Where your settings live

All settings are stored locally in the browser's IndexedDB and chrome.storage — on your own machine. The bytes never leave your computer.

What is stored

• Your blocklist, allowlist, category preferences, and schedule.
• Whether the focus timer is active and when it ends.
• A cryptographic hash (SHA-256) of your password, if you set one. The plaintext password is never stored anywhere.
• Counts of how many sites have been blocked (for the in-extension statistics view).
• Your interface language preference (Hebrew or English).
• Whether SafeSearch enforcement is on.

Network requests

Kosher Browser makes zero outgoing network requests. You can verify this yourself: open Chrome DevTools on the extension popup or options page, go to the Network tab, and use the extension. The list stays empty. No third-party SDKs, no fonts loaded from a CDN, no analytics beacons.

Permissions explained

• storage — stores your settings via chrome.storage.local.
• alarms — runs hourly checks of the schedule (is the current time inside a block window?) and end-of-focus-session timing.
• declarativeNetRequest — performs URL-level blocking. The rule list is built only from your local settings.
• declarativeNetRequestWithHostAccess — required to scope SafeSearch redirects to Google/Bing/etc. host names.
• host: <all_urls> — required to block or allow any URL the user chooses. Outside YouTube the extension does not read page content — DNR operates at the URL level only.
• scripting — registers a page-world script on youtube.com only while "Block YouTube ads" is on. The script deletes the ad slots from YouTube's own player data before the player reads them. It is registered when you enable the option and unregistered when you turn it off, it reads no personal data, and it sends nothing anywhere.
• scripting (image hider) — registers a script on every site only while the image hider is on. It blurs images and videos until you click them. It reads nothing but the on-screen size of image elements, so small icons can stay visible; it never inspects what an image contains, never stores anything, and never sends anything anywhere. Sites on its exception list never receive the script at all.
• content_scripts on youtube.com — The one exception is YouTube: if you turn on "Allow only approved YouTube channels", a script on youtube.com reads the channel name of the video you are watching so it can compare it with your allowlist. That read happens on your device, the result is never stored, and nothing is sent anywhere.

Third parties

None. No third-party services are contacted, no third-party libraries phone home, no fonts are fetched from Google or anywhere else.

Google Limited Use Policy compliance

Kosher Browser complies with the Google API Services User Data Policy, including the Limited Use requirements. Any user data the extension touches is used solely to provide the user-facing feature (blocking sites, focus timer, etc.) and is never transferred to third parties, used for advertising, used to improve unrelated products, or read by any human at our end — because there is no server-side component.

Cookies

None.

Children

Kosher Browser is not directed at children under 13. We don't collect any data from anyone, including children.

Changes

If we ever add an optional cloud-sync feature, it will be strictly opt-in and accompanied by an updated version of this policy that explains what is uploaded and where. The default forever is local.

Contact

Questions, security reports, or bug reports: dayanimo@gmail.com.