Privacy and permissions

This page summarizes how Phishing Shield processes data and the permissions it requests in the browser. It is for whoever administers the extension and for the security or data protection team that must review it.

What the extension reads on the device

The analysis happens on the device itself. For every page visited, the extension reads:

Data	What for	Does it leave the device?
Tab address	Typosquatting, homoglyphs and phishing databases	Only to confirm a match against the lists: the hostname or the address
Page content	Cloning, AiTM, ClickFix, QR, VNC and blobs	Only a snippet without form data, inside a block report
HTTP response headers	AiTM kit detection	No
Tab screenshot	Shown next to the warning to identify the page	Only inside a block report
Cookie changes (name and domain only)	Token theft	No
WebSocket and cross-window messages	Token theft	No. Only the resulting alert is sent
Text the page copies to the clipboard	ClickFix	No
The page’s local storage keys	Token theft. Only keys shaped like tokens are read	No

The extension does not read passwords typed into forms, personal messages or documents, history beyond open tabs, card data or browser sync data.

What it sends to Ironchip

Activation: the license, an installation and device identifier, the browser, the user’s email and the device name. Before activating, the user explicitly accepts the privacy policy and the terms of service, and the extension stores the date and the accepted version.
Block reports: the blocked address, the detection type, the severity, the user’s action (block or continue), the page screenshot and a snippet of its HTML. Administrators see them in the company metrics.
Match confirmation: the hostname, URL or suspicious IP, when the local check needs confirming.
AiTM kit activity: the kit family and the hostname.
Lists and settings: the extension periodically downloads the trusted domain and phishing lists, and the company settings. These requests send no browsing data.

It does not send form values, passwords or cookies, and it uses no third-party analytics. To check suspicious IP addresses, it resolves the hostname with a public DNS service.

Retention

Data	Period
Activation record	For the life of the license. Deleted 30 days after it expires or when the installation is revoked
Block reports	For the life of the license. Administrators can export them
Audit log	12 months
Server access logs	30 days

What the extension stores in the browser (license state, cached lists, block history) is deleted when it is uninstalled.

The services are hosted in the European Union. Ironchip Telco, S.L. is the data controller. To exercise your rights of access, rectification, erasure, portability, restriction or objection, write to dpo@ironchip.com. We reply within 30 days. If we do not resolve your concern, you can lodge a complaint with the Spanish Data Protection Agency.

What each permission is for

Permission	What for
Access to all addresses (`<all_urls>`)	Inspect every navigation, because attackers register lookalike domains anywhere. The page is only modified to show the warning
`tabs`	Relate events to their tab, take it to the warning and capture the thumbnail
`webNavigation`	Run the checks before and after the page loads
`webRequest`	Read the main navigation headers to detect AiTM kits. It does not block or modify requests
`scripting`	Extract the page content when the usual script cannot run. Read-only
`storage` and `unlimitedStorage`	Store the license state, cached lists, the company’s domain list and the block history
`alarms`	Periodic tasks: refresh the lists, sync settings every hour and retry reports
`notifications`	Warn about a block even if the tab is in the background
`activeTab`	Temporarily allow a domain from the extension window

More information

Was this page helpful?