Privacy Policy — InclusiveWeb Accessibility Scanner

1. What data we process

When you sign in and start a scan, the Extension processes (for the no-account guest mode, see section 2):

• Cabinet email — typed on the sign-in screen; sent to api.inclusiveweb.com.ua to request a one-time code. Purpose: identify your account.
• One-time code (OTP) — typed on the verify screen; sent to api.inclusiveweb.com.ua to sign in.
• Access tokens (JWT) — issued by the backend after sign-in; stored locally in chrome.storage.local (this device only). Purpose: keep you signed in.
• Selected UI language — stored locally in chrome.storage.local.
• In-progress scan state — generated during a scan; stored locally to show progress if you reopen the panel.
• Page URLs from your cabinet — fetched from api.inclusiveweb.com.ua for the site you pick; held in memory only during the scan.
• Accessibility findings — computed locally in your browser by the Extension's bundled scan engine inside each opened tab; sent to api.inclusiveweb.com.ua and stored in your InclusiveWeb cabinet to produce your audit report.

2. Guest checks without an account

You can use the Extension without signing in. In guest mode it checks the page open in your tab, and only after you press the check button. We never ask for an email or a password, so we do not know who ran the check and do not build a profile for you.

What a guest check sends to api.inclusiveweb.com.ua:

• Page URL and title — the address of the checked page and its <title>.
• Accessibility issues found — the rule id, its description, the CSS selector of the offending element and a fragment of that element's HTML (e.g. an <img> with no alt). The fragment is what lets us highlight the element on the page and show what to fix.
• Rules the page passed — along with those needing manual review; the score is computed from them.
• Technical scan details — the viewport sizes of the desktop and mobile passes, how long the check took, and your browser's User-Agent string.
• IP address — sent by your browser with any HTTPS request. We use it only to count the free-check limit, not to identify you.

The free-check limit is counted per day and per site, by IP address. The Extension shows how many checks are left and when the limit resets.

The result of a guest check is stored on the InclusiveWeb backend and opens through a link with a random token (my.inclusiveweb.net/guest-report/…). The link is tied to the checked page, not to you, but anyone holding it can open the report — so share it deliberately. You can claim the result into a cabinet in one click, after which it becomes part of your account. Locally, in chrome.storage.local, the Extension keeps the last guest result and a short history of guest checks (up to 60 entries) to show them in the panel; uninstalling the Extension removes them from your device.

3. What we do NOT collect

• Any data from pages you did not check: signed in — only sites in your InclusiveWeb cabinet's site list; in guest mode — only the page you opened and pressed check on.
• Passwords, cookies, payment data, form contents, or page text beyond what the scan engine references (HTML snippets near accessibility issues, e.g. an <img> with missing alt text).
• Analytics, telemetry, or advertising IDs. We do not build a browser fingerprint: in guest mode the IP address and User-Agent are used only for the free-check limit (section 2).
• Browsing history beyond the URLs you scan.

4. Who data is shared with (third parties)

The Extension communicates only with the InclusiveWeb backend (api.inclusiveweb.com.ua) over HTTPS. It does not send data to any other third party.

The accessibility-scan engine is bundled with the Extension and runs locally in your browser — it does not phone home.

Google Fonts (fonts.googleapis.com) are loaded for typography; Google's privacy policy applies to those requests.

5. Browser permissions

The Extension uses the minimum permissions needed: tab access and scripting to open your pages in background tabs and run the check; access to all sites, for exactly the page you opened (which page that will be is not known in advance, so Chrome asks broadly); local storage to keep you signed in and to save progress and guest results; side panel and notifications for the UI and scan-finished message. The Extension does not use these permissions to collect any other data.

On the debugger permission specifically: to evaluate the mobile layout, the Extension turns on Chrome's built-in screen emulation for a second or two (375×812, double pixel density, touch input). Chrome warns about this with a yellow bar at the top, which disappears once the check is done. Through this mechanism we change only the screen size and input mode — we do not read network traffic, the console or page data through it, and the session is always detached after the pass.

6. Storage & retention

• Tokens / language / scan state — in chrome.storage.local: until you sign out, uninstall the Extension, or clear your Chrome storage.
• Scan results — on the InclusiveWeb backend: per your account's retention policy in the cabinet.
• Guest check results — on the InclusiveWeb backend, reachable through their token link. If you claim a result into a cabinet, your account's retention policy applies from then on. If you do not, you can ask us to delete the report by sending its link to [email protected].
• Last guest result and its history — in chrome.storage.local, up to 60 entries: until you uninstall the Extension or clear your Chrome storage.

7. Your rights

• Sign out — at any time (header → email pill → sign out); clears all tokens from your device. In guest mode there is nothing to sign out of — no account is created.
• Uninstall the Extension — to remove all locally stored data.
• Request deletion — of your scan history by emailing [email protected].

8. Security

All network requests use HTTPS to api.inclusiveweb.com.ua. Tokens are stored in chrome.storage.local, sandboxed per extension by Chrome. The Extension is built on Manifest V3.

9. Changes

We may update this policy; the “Effective date” will change accordingly.

10. Contact

Questions or requests about this policy:

• Email: [email protected]
• Telegram: t.me/inclusiveweb_support
• Website: inclusiveweb.net
• Cabinet: my.inclusiveweb.net