Legal
Last updated: March 6, 2026
TL;DR
ZeroExpose ("we", "us", "our") operates the website at zeroexpose.app and the ZeroExpose browser extension. This policy explains what data we collect, why, and how you can control it.
For privacy enquiries contact us at zeroexposeapp@gmail.com.
The ZeroExpose browser extension performs all detection entirely on your device. The extension:
Detection rules (regex patterns) are bundled inside the extension and run entirely within your browser sandbox. We are architecturally unable to access what you type.
When you create an account on zeroexpose.app we collect:
Email address
Used for passwordless authentication (OTP). We send you a one-time code to sign in. No password is ever stored.
Extension session token (hashed)
A random 64-character token is created when you connect the extension. We store only its SHA-256 hash — the raw token never touches our database.
Detection settings
Your sensitivity preferences and enabled detection categories, so they sync across devices.
Subscription status
Plan type and billing period, so the extension knows whether your subscription is active. Payment details are handled entirely by Stripe — we never see your card number.
Audit logs are disabled by default. Team administrators can enable them for compliance purposes. When enabled, the extension sends a record of detection events (pattern type and timestamp — never the raw secret value) to our servers. Members are notified when audit logging is active.
The portal uses a secure, HTTP-only session cookie set by Supabase Auth to keep you signed in. No advertising or tracking cookies are used.
The extension stores your auth token, email address, and settings inchrome.storage.local on your device. This data is not synced to Chrome's cloud storage.
Your account data is retained for as long as your account exists. You can request deletion at any time by emailing zeroexposeapp@gmail.com. We will delete your email, settings, session tokens, and any audit logs within 30 days.
If you are in the European Economic Area or United Kingdom, you have the right to access, correct, port, or erase your personal data. You also have the right to object to processing and to lodge a complaint with your local data protection authority. To exercise any of these rights contact zeroexposeapp@gmail.com.
ZeroExpose is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
We may update this policy as the product evolves. Material changes will be communicated via email or a notice on the portal. The "Last updated" date at the top always reflects the current version.