Privacy

HasTrust is built to be privacy-respecting. We collect no browsing history and no personal data — with one clearly-marked exception you control: an email address, and only if you choose to set a price alert (see below).

The browser extension

By default the extension reads only the current page's domain (e.g. example.com) to look up an assessment. It does not read the full URL, page contents, your cart, form fields, or any personal data — the only network request it makes is to our API with that bare domain.

One exception, and only when you ask for it: on a product page you can click “Check this product”. That sends the product's URL (with tracking parameters stripped) to our API so we can fetch its price and find cheaper or better alternatives. Nothing is sent until you click; we never read your cart, account, or form fields.

On marketplace product pages (Amazon, bol.com, eBay) sold by a third-party seller, that same explicit product check also includes the seller's name as shown in the page's own "sold by" block — so we can warn about the actual counterparty, not just the platform. It is never sent without the product check.

On search-engine result pages (Google, Bing, DuckDuckGo) the extension looks up the domains of the results in one batched request so it can show a trust badge next to shops we already know. Only those result domains are sent — never your search query. This can be turned off in the extension's settings ("Badges on search results").

The right-click "Scan selection for scams" action sends the text you selected to our API for scam analysis — only when you explicitly choose it from the menu, never automatically. To time its checkout warning the extension also checks locally whether a payment-card field is present on the page; the field's contents are never read or transmitted.

Price alerts (optional email)

If — and only if — you tap “Watch price” and enter your email, we store that address to send the price-drop alert you asked for. It is double opt-in: we email a confirmation link and send nothing until you click it. We use your address for that alert alone — we never sell it, share it, or send marketing. Every alert has an unsubscribe link, and unsubscribing deletes your address.

What we store

Anonymous usage events (the domain checked, the event type, and a random anonymous id) and community trust votes. Votes store a one-way hash of your IP solely for rate-limiting. None of this identifies you. We keep aggregate counts; we do not sell data.

In your browser

We store your extension settings (theme, quiet and auto-open toggles, sites you've muted, and the pill's position) and a random anonymous id in your browser's local storage. No tracking cookies.

Third parties

Assessments cite public web sources you can visit. Site and brand logos load from Google's public favicon service (which sees the domain, not you). If you choose to click a “Buy” or seller link, it opens through our affiliate partner (Sovrn/VigLink), which may record the click to attribute a purchase — a commission that never changes your price. We disclose this next to every such link.