Skip to content
SiteScore LogoSiteScore
Legal & Privacy

Privacy Policy

SiteScore is built on a local-first architecture. We do not harvest browsing history, track user activity, or monetize personal information.

Summary of Core Commitments

Effective Date: October 2026

  • • No account required: The core features of SiteScore require no account creation or login.
  • • Local-first DOM analysis: Audits run entirely within your local browser runtime.
  • • No third-party trackers: Neither the extension nor this website utilizes tracking cookies or advertising pixels.
  • • Zero monetization of user data: We do not sell, rent, or trade your page audits or browsing activity.

1. Scope & Ecosystem

This Privacy Policy applies to the SiteScore Chrome extension and the marketing and documentation website located at https://sitescore.trustoryx.digital, operated by Trustoryx (“we,” “us,” or “our”).

2. Data Processed by the Chrome Extension

The SiteScore Chrome extension is designed from first principles as an in-browser utility. Its data handling is strictly scoped to the tasks you initiate:

On-Page DOM Data

SiteScore inspects titles, headings, meta tags, schema markup, and accessibility attributes in the active tab. This data is processed in memory and never dispatched to Trustoryx servers.

Local Storage & Snapshots

Audit history, custom preferences, and settings are stored locally on your device via Chrome Local Storage and IndexedDB. You can delete individual audit records or clear history at any time.

Optional External API Keys

If you optionally configure external provider keys (such as OpenAI for AI assistance or Moz for domain metrics), these credentials remain stored locally on your machine and are only transmitted directly to the respective third-party API endpoint upon your explicit action.

No Browsing Tracking

SiteScore does not record the URLs you browse in the background. Audits are exclusively executed on-demand when you interact with the extension.

3. Chrome Extension Permissions Justification

In strict adherence to the Chrome Web Store Minimum Permissions policy, SiteScore requests only permissions necessary for its operational features:

activeTab

Enables SiteScore to inspect the HTML markup and DOM structure of the current tab when you trigger an audit.

scripting

Used to safely inject the DOM scanner and inspector highlighting into the document without modifying the underlying webpage.

sidePanel

Allows SiteScore to dock as a native Chrome Side Panel for persistent auditing alongside your browsing.

storage

Stores your preferences, theme options, and historical audit snapshots locally on your device via chrome.storage.local and IndexedDB.

webNavigation

Detects Single Page Application (SPA) client-side URL transitions so you can refresh audits when the route changes.

downloads

Allows exporting audit reports directly to your local computer in CSV, JSON, HTML, or printable formats.

alarms

Maintains background service worker execution during multi-step processes like multi-page link crawling.

4. Data Collected by the Website

When you visit https://sitescore.trustoryx.digital:

  • Contact Inquiries: When submitting an inquiry through our contact form, we collect your name, email address, inquiry topic, and message. This data is strictly used to communicate with you regarding your request.
  • Server Telemetry: Standard web server connection logs (such as IP address, user-agent, and requested file) may be temporarily processed by the hosting network infrastructure solely for cybersecurity, DDoS mitigation, and operational uptime.

5. Data Retention & Deletion

Because audit data is stored locally in your browser, you retain complete data sovereignty. You can delete historical audit snapshots from the extension side panel at any time, or clear all extension data through Chrome Settings > Clear Browsing Data.

Contact submissions received via email are retained only for as long as necessary to address your inquiry or maintain compliance records.

6. Security Engineering

SiteScore incorporates proactive defensive programming:

  • SSRF Defense: Internal crawlers and resource fetchers enforce strict host boundaries, rejecting calls to localhost, private IP subnets (RFC 1918), and cloud metadata endpoints.
  • CSV Formula Injection Sanitization: Exported reports automatically prefix formula execution characters (=, +, -, @, \t, \r) with single quotes to protect spreadsheet users.
  • XSS Prevention: All UI rendering relies on safe DOM constructors rather than unsafe HTML interpolation.

7. Contact Information

For questions regarding this Privacy Policy or your data, please contact our Privacy Team:

Trustoryx Compliance & Privacy Desk
Email: support@trustoryx.digital