# Privacy and permissions

> What data the Phishing Shield extension reads on the device, what it sends to Ironchip, how long it is kept and what each permission is for.

URL: https://docs.ironchip.com/en/phishing-shield/privacidad-y-permisos/

This page summarizes how Phishing Shield processes data and the permissions it requests in the browser. It is for whoever administers the extension and for the security or data protection team that must review it.

## What the extension reads on the device

The analysis happens on the device itself. For every page visited, the extension reads:

| Data                                  | What for                                           | Does it leave the device?                                              |
| ------------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------------- |
| Tab address                           | Typosquatting, homoglyphs and phishing databases   | Only to confirm a match against the lists: the hostname or the address |
| Page content                          | Cloning, AiTM, ClickFix, QR, VNC and blobs         | Only a snippet without form data, inside a block report                |
| HTTP response headers                 | AiTM kit detection                                 | No                                                                     |
| Tab screenshot                        | Shown next to the warning to identify the page     | Only inside a block report                                             |
| Cookie changes (name and domain only) | Token theft                                        | No                                                                     |
| WebSocket and cross-window messages   | Token theft                                        | No. Only the resulting alert is sent                                   |
| Text the page copies to the clipboard | ClickFix                                           | No                                                                     |
| The page's local storage keys         | Token theft. Only keys shaped like tokens are read | No                                                                     |

The extension does **not** read passwords typed into forms, personal messages or documents, history beyond open tabs, card data or browser sync data.

## What it sends to Ironchip

- **Activation:** the license, an installation and device identifier, the browser, the user's email and the device name. Before activating, the user explicitly accepts the privacy policy and the terms of service, and the extension stores the date and the accepted version.
- **Block reports:** the blocked address, the detection type, the severity, the user's action (block or continue), the page screenshot and a snippet of its HTML. Administrators see them in the company metrics.
- **Match confirmation:** the hostname, URL or suspicious IP, when the local check needs confirming.
- **AiTM kit activity:** the kit family and the hostname.
- **Lists and settings:** the extension periodically downloads the trusted domain and phishing lists, and the company settings. These requests send no browsing data.

It does not send form values, passwords or cookies, and it uses no third-party analytics. To check suspicious IP addresses, it resolves the hostname with a public DNS service.

## Retention

| Data               | Period                                                                                            |
| ------------------ | ------------------------------------------------------------------------------------------------- |
| Activation record  | For the life of the license. Deleted 30 days after it expires or when the installation is revoked |
| Block reports      | For the life of the license. Administrators can export them                                       |
| Audit log          | 12 months                                                                                         |
| Server access logs | 30 days                                                                                           |

What the extension stores in the browser (license state, cached lists, block history) is deleted when it is uninstalled.

The services are hosted in the European Union. Ironchip Telco, S.L. is the data controller. To exercise your rights of access, rectification, erasure, portability, restriction or objection, write to [dpo@ironchip.com](mailto:dpo@ironchip.com). We reply within 30 days. If we do not resolve your concern, you can lodge a complaint with the Spanish Data Protection Agency.

## What each permission is for

| Permission                             | What for                                                                                                                       |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Access to all addresses (`<all_urls>`) | Inspect every navigation, because attackers register lookalike domains anywhere. The page is only modified to show the warning |
| `tabs`                                 | Relate events to their tab, take it to the warning and capture the thumbnail                                                   |
| `webNavigation`                        | Run the checks before and after the page loads                                                                                 |
| `webRequest`                           | Read the main navigation headers to detect AiTM kits. It does not block or modify requests                                     |
| `scripting`                            | Extract the page content when the usual script cannot run. Read-only                                                           |
| `storage` and `unlimitedStorage`       | Store the license state, cached lists, the company's domain list and the block history                                         |
| `alarms`                               | Periodic tasks: refresh the lists, sync settings every hour and retry reports                                                  |
| `notifications`                        | Warn about a block even if the tab is in the background                                                                        |
| `activeTab`                            | Temporarily allow a domain from the extension window                                                                           |

## More information

- [Deploy in your organization](https://docs.ironchip.com/en/phishing-shield/despliegue/)
- [Warnings and false positives](https://docs.ironchip.com/en/phishing-shield/avisos-y-falsos-positivos/)