Privacy Policy
Version 1.2.0 · Last updated 30 October 2026 · Applies to the Chrome/Edge and Firefox builds.
1. Who this policy is from
LeadHarvest is an independent browser extension built and maintained by Amit. For any question about this policy, or to ask for something to be corrected or deleted, write to br19shc39@gmail.com.
2. What the extension does
When you click the scrape button, the extension reads the page you are currently viewing and looks for contact information: names, phone numbers, email addresses, designations, company names and postal addresses. It builds one or more records from what it finds, shows them to you in a dashboard, and can export them to a file on your device. This processing happens in the page's own context inside your browser. The page content is not transmitted anywhere as part of this process.
3. What is stored on your device
Everything below lives in your browser's local extension storage (chrome.storage.local in Chrome
and Edge, storage.local in Firefox). It stays on that device and is readable only by this extension
inside that browser profile.
| Stored item | What it contains | Why |
|---|---|---|
| Records | The contact details you scraped, their confidence scores, the source URL, the page title and a timestamp. Up to 5,000 records. | So your list survives closing the browser and can be exported later. |
| History | One entry per scrape: time, URL, page title, page type, extraction method, record count, duration and the export format used. Up to 500 entries. | So you can see what was scraped when, and re-export a past scrape. |
| Logs | Diagnostic events across 15 categories (lifecycle, sessions, field extraction counts, quality, duplicates, compatibility, exports, storage, errors, performance, interactions) with a level, a scope and small technical details. Up to 1,200 entries by default. | To debug a site that misbehaves. |
| Settings | Your field schema, scrape options, export preferences and — only if you choose cloud AI — the endpoint, model name and API key you entered. | So the extension behaves the same next time. |
Log redaction
Log entries pass through a redaction step before they are written: email addresses become
[email] and phone numbers become [number]. This is on by default and can be turned off
in Settings, but there is no reason to. Logs never contain page content beyond short technical summaries.
4. What is never collected
- No account, sign-up, name or email address is required to use the extension.
- No analytics, crash reporting, telemetry, fingerprinting or advertising identifiers.
- No browsing history, no list of the sites you visit, no keystroke or form data.
- No page content is uploaded, not even the pages you scrape.
- Nothing is sold, rented or shared with data brokers — there is nothing to share.
5. Network requests
Default configuration: zero network requests. With the AI advisor set to “Local rules” (the default), the extension never opens a connection of its own. It does not load remote scripts, fonts, images or styles — every file it uses ships inside the extension package.
The one exception you can enable yourself: cloud AI. If you go to AI advisor → Cloud AI and add an API key, the extension will send a request to the endpoint you chose when you press a button that asks for advice. That request contains:
- a short summary of the page's technical signals (how many
tel:links, whether tables or structured data exist, the page type), - the page title,
- the list of available field names, so the model can answer in a usable shape.
It does not contain the full page HTML, your scraped records, your history or your logs. The request goes directly from your browser to the provider you selected (Sarvam AI, OpenAI, Groq or your own endpoint) using your key; that provider's own privacy policy governs what happens on their side. Turn cloud AI off and no request is ever made.
6. Permissions and why each one is needed
| Permission | Why the extension asks for it |
|---|---|
storage | To keep your records, history, logs and settings on your device. |
unlimitedStorage | So a large contact list does not hit the small default quota and silently fail to save. |
scripting + activeTab | To inject the extractor into the page you asked it to read. Injection happens only when you click scrape, never in the background. |
downloads | To save an exported Excel, CSV, PDF or TXT file to your Downloads folder. |
contextMenus | To add the right-click “scrape this page” entry. |
<all_urls> (site access) | The whole point is to read whichever page you are on, so the extension must be able to reach any site. It declares no automatic content scripts; nothing runs on a page until you act. You can narrow this at any time in your browser's extension settings. |
7. Sharing diagnostics with the developer
Settings → Diagnostics has a button labelled Share logs with developer. It does nothing until you press it. When you do, the extension builds a diagnostic bundle and hands it to your own email app, addressed to br19shc39@gmail.com. The extension itself uploads nothing — the message leaves through your mail client, and you can read, edit, add to or delete it before sending.
The bundle contains:
- counts and rates — sessions started/completed/failed, records extracted, per-field success and missing counts, duplicates, exports, errors;
- site hostnames only (never full URLs, never page text);
- timings, browser name and version, operating system, extension version;
- your settings shape — which fields are enabled, which options are on — and whether an API key is set (never the key itself);
- the note you typed, if any.
It does not contain any email address, phone number, contact name, address, page content or API key that the extension holds. A capability report inside the bundle states which checks this build performs and which it does not, so nothing is silently missing.
8. Exports
When you export, the file is generated inside your browser and written to your Downloads folder by the browser's own download manager. It is not uploaded anywhere. Once the file exists on your disk, it is your responsibility — treat exported contact lists like any other personal data.
9. How long data is kept, and how to delete it
Data is kept until you delete it. In the dashboard, Settings → Data on this device has Clear records, Clear history and Clear logs, each of which wipes that store immediately and irreversibly. Removing the extension from your browser deletes all of it as well. Because nothing is stored on a server, there is no copy for us to delete and no deletion request to file — but you are welcome to write if you want confirmation of how this works.
10. Your rights and your own obligations
Because we hold no data about you, there is nothing for us to disclose, correct or erase on our side. Your
records are in your hands, which also means the obligations that come with them are yours: if you collect other
people's contact details, you are the one processing their personal data. In India that means the Digital
Personal Data Protection Act, 2023 — collect only what you need for a lawful purpose, keep it accurate, secure
it, and honour requests to erase it. Elsewhere, equivalent rules such as the GDPR apply. Respect the terms of
service of the sites you read, and their robots.txt.
11. Children
The extension is a business tool and is not directed at children. It does not knowingly collect any information about anyone, including children.
12. Security
The extension contains no remote code, no eval, no obfuscation and no third-party libraries — the
source you can read is exactly what runs. All values rendered into the dashboard are HTML-escaped before they are
displayed, so a malicious page cannot inject markup into the extension's own UI. Your API key, if you set one, is
stored in the same local storage as everything else; anyone with access to your browser profile can read it, so
treat it like a saved password and revoke it if you stop using cloud mode.
13. Changes to this policy
If a future version changes what is stored or transmitted, this page will be updated and the version number and date at the top will change. Material changes will also be noted in the extension's release notes. Continuing to use a new version means you accept the policy published with it.
14. Contact
Questions, corrections or a site that needs a selector preset:
br19shc39@gmail.com
Instagram: @osintgram_io