Privacy policy

The short version

Viewport renders the pages you preview inside your own browser. The pages you open, what they contain, the screenshots you take, the recordings you make and the baselines you save never leave your machine. There is no analytics, no telemetry, no crash reporting and no session recording in the extension.

The extension contacts Orbitex AIO for exactly one reason: to find out whether this browser has a paid subscription, and to start a checkout when you ask it to. Those two requests carry no information about what you were looking at.

What stays on your device

All of the following is stored by the extension in your browser and is removed when you uninstall it. None of it is uploaded anywhere.

• Your board: which devices are open, their zoom, rotation, the URLs in comparison panes.
• Saved scenes, custom device profiles and saved page states.
• Visual regression baselines, stored as images in IndexedDB.
• Your language, theme and toolbar preferences.
• A cached copy of your subscription status, so the toolbar does not have to ask the server on every click.

Saved page states deserve a specific note. When you save one, Viewport reads the localStorage and sessionStorage of the page in the preview so you can push that state back later. Those values are whatever the site put there, they can include a session token, and they are stored unencrypted in your browser like every other extension setting. Save states from sites you trust, and delete the ones you no longer need.

What the extension sends, and when

The extension makes network requests to Orbitex AIO in two situations and no others. You can verify this by searching the source for the word fetch.

Checking your subscription

Sends an install id and, if it has one, a signed token from a previous check. Returns whether this browser is Pro. Runs after a purchase and periodically after that.

Starting a checkout

Sends the install id and which plan you clicked, and returns a Lemon Squeezy checkout URL to open.

The install id is a random string generated in your browser the first time the extension runs. It is not derived from your hardware, your account, your IP address or anything else about you. It exists so a payment can find its way back to the browser that started it.

Neither request carries a URL you visited, a page title, a screenshot, a recording, or anything else about your browsing.

What the server stores

If you buy a subscription, Orbitex AIO stores a single row about it. That row is:

• Your email address, as given to the payment provider at checkout.
• Which plan you are on, and its status: active, cancelled, past due or expired.
• The Lemon Squeezy subscription, customer and order identifiers.
• The renewal date and, if you cancel, the date access ends.
• The links Lemon Squeezy gives us for managing and updating the subscription.
• When the row was created and last changed.

Alongside it we store the install ids that have claimed the subscription, so the extension can be used in more than one browser, and the identifiers of webhook deliveries we have already processed, so a payment provider retry cannot grant the same thing twice or send you a second confirmation email.

There is no other table. There is no record of pages viewed, devices previewed, features used, times of use, or anything else. This is not a policy choice that could quietly change without you noticing: there is nowhere for such data to go.

Payments

Payments are handled by Lemon Squeezy, who act as merchant of record. Your card details are entered on their systems and are never seen by, sent to, or stored by Orbitex AIO. We receive your email address, the plan, and the subscription status.

Lemon Squeezy processes your payment information under their own privacy policy, at lemonsqueezy.com/privacy.

Email

We send transactional email only: a confirmation when a subscription starts, a confirmation when one is cancelled, and a sign-in link when you ask for one on the account page. These are sent over SMTP from a mailbox we control.

There is no mailing list and no marketing email. Your address is not shared with, sold to, or rented to anybody.

Permissions the extension asks for

Chrome shows a permission list at install time that is worth explaining, because several of the entries sound broader than what they do.

activeTab and scripting

Lets the toolbar appear on the tab you clicked the icon on. Viewport does not run on pages until you open it there.

declarativeNetRequest

Rewrites the user agent and client hint headers for the preview frames only, which is what makes a site serve its mobile layout.

storage

The on-device settings described above.

downloads

Saves your screenshots and recordings to your downloads folder.

tabCapture and offscreen

Records the tab to a video file. The frames are encoded locally and written to disk. Nothing is streamed anywhere.

debugger (optional)

Requested only when you turn on region emulation, which needs Chrome's own protocol to override geolocation, locale and timezone. Chrome shows a warning banner while it is attached, and Viewport detaches when you turn it off or close the tab.

host access (optional)

Requested at the moment you preview a site, for that site. Declining it means the preview cannot load, and nothing else.

Chrome Web Store data disclosures

For the avoidance of doubt, and to match the certifications made on the store listing:

• We do not sell or transfer user data to third parties, other than for the approved use case of processing a payment.
• We do not use or transfer user data for purposes unrelated to the item's single purpose.
• We do not use or transfer user data to determine creditworthiness or for lending purposes.

How long we keep it

• Subscription records are kept while the subscription exists and for as long afterwards as tax and accounting law requires us to keep a record of the sale.
• Install ids are kept alongside the subscription and are deleted with it.
• Webhook delivery identifiers are kept briefly, only long enough to stop a duplicate delivery being processed twice.
• On-device data is kept until you delete it or uninstall the extension. We cannot delete it for you, because we cannot see it.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@orbitexaio.com from the address on the subscription and we will answer within 30 days. Deleting the record ends the subscription, because the record is the subscription.

Depending on where you live you may also have the right to complain to a data protection authority. Nothing here is intended to limit that.

Children

Viewport is a developer tool and is not directed at children. We do not knowingly collect information from anyone under 13.

Changes

If this policy changes in a way that affects what we collect or what we do with it, the date at the top changes and the previous version is superseded. Continuing to use Viewport after a change means the new version applies.

Questions about any of this go to support@orbitexaio.com.