================================================================================
PRIVACY POLICY & PERMISSION AUDIT: ANTIZERT EXTENSION
================================================================================
Effective Date: October 31, 2026
Last Updated: October 31, 2026
At AntiZert ("we", "us", or "our"), user privacy, browser security, and operational transparency are our fundamental principles. We strictly believe in zero data collection, zero telemetry, and 100% local, client-side execution.
This document serves two vital purposes:
1. It outlines our comprehensive Privacy Policy regarding user data handling.
2. It provides an explicit technical evaluation answering whether all requested permissions are strictly necessary, why sensitive permissions (such as the Cookies API or broad wildcard access) were intentionally omitted, and how this architecture protects user safety.
================================================================================
1. CORE PRIVACY COMMITMENTS
================================================================================
• ZERO PERSONAL DATA COLLECTION: AntiZert does not collect, record, log, harvest, transmit, or sell any personal data, account information, game credentials, IP addresses, or browsing history.
• 100% CLIENT-SIDE OPERATION: All URL parameter injections, byte-array decoding, redirect processing, and statistics counters execute entirely within the local browser environment on your device.
• NO EXTERNAL SERVERS OR TELEMETRY: The extension maintains zero background connections to external servers, cloud databases, analytics providers (no Google Analytics, Mixpanel, or Sentry), or third-party networks.
• NO ADVERTISING OR AFFILIATE INJECTIONS: AntiZert exists solely to remove ads and bypass unwanted sponsor gates; it does not replace them with alternative ads, banners, or affiliate tracking links.
================================================================================
2. COMPREHENSIVE BREAKDOWN OF REQUESTED PERMISSIONS
================================================================================
To comply with the Google Chrome Web Store Least Privilege Principle, AntiZert requests only the bare minimum set of permissions necessary to function:
1. Permission: "storage" (Chrome Local Storage API)
--------------------------------------------------------------------------------
• What it does:
Provides access to `chrome.storage.local`—a sandboxed key-value data store on your computer.
• Why it is required:
Used exclusively to persist your configuration settings across browser sessions (e.g., Master Protection toggle, Auto-Param Bypass toggle, Sponsor Popup Blocker toggle, and Toast Alert toggle) as well as your cumulative local statistics (number of ads bypassed, gates skipped, and estimated seconds saved).
• Privacy Guarantee:
This data never leaves your computer. It is stored locally in your Chrome user profile and is deleted automatically if you uninstall the extension.
2. Host Permissions (Targeted Game Domains & Intermediate Sponsor Gate)
--------------------------------------------------------------------------------
• Domains requested:
- `*://*.zertalious.xyz/*` (Intermediate sponsor redirect gate)
- `*://krunker.io/*` and `*://browserfps.com/*`
- `*://shellshock.io/*` and its official school/proxy mirrors (algebra.best, biologyclass.club, eggcombat.com, etc.)
- `*://1v1.lol/*` and `*://1v1.school/*`
- `*://surviv.io/*`, `*://ev.io/*`, `*://digdig.io/*`, `*://voxiom.io/*`, `*://paper-io.com/*`
• Why they are required:
AntiZert works via Content Scripts (`content.js` and `content-bridge.js`) executed at `document_start`:
a) On supported game domains: It verifies whether the `showAd` query parameter is present. If missing, it pre-injects the validated hex timestamp to satisfy the cheat script's verification logic before the redirect triggers.
b) On the intermediate gate (`zertalious.xyz`): It reads the encoded destination parameter (`ref`) or cookie, decodes the original game URL, and triggers an immediate client-side redirect back to the match.
• Exclusion Rules:
Non-game paths such as `*://krunker.io/social*` and `*://krunker.io/editor*` are explicitly excluded to prevent unnecessary script execution.
================================================================================
3. TECHNICAL AUDIT: ARE ALL THESE PERMISSIONS REALLY NEEDED?
================================================================================
A common question when evaluating browser extensions is: "Are all these permissions truly necessary, or is the extension over-permissioned?"
Our Answer: YES, EVERY SINGLE PERMISSION IS STRICTLY NECESSARY, AND ALL EXCESSIVE OR HIGH-RISK PERMISSIONS HAVE BEEN DELIBERATELY EXCLUDED.
Here is why our permission model is the absolute safest and most optimal:
1. Why We DO NOT Request the Sensitive "cookies" Permission:
The original userscript utilized `GM_cookie` to read the `ref` cookie on the gate page. However, in Chrome Extensions, requesting the top-level `"cookies"` permission triggers scary browser install warnings ("Can read and modify your cookies") and introduces serious scrutiny during Chrome Web Store reviews.
Instead, AntiZert achieves the exact same functionality securely using native `document.cookie` scoped strictly inside the isolated content script on `*.zertalious.xyz/*`. Because the cookie is set client-side by the gate, no broad `"cookies"` permission is required! This completely protects your session cookies across the web.
2. Why We DO NOT Request "<all_urls>":
Many ad-blockers carelessly request `<all_urls>` or `*://*/*`, giving them the ability to inspect every site you visit. AntiZert strictly rejects this approach. Our extension only requests permissions on the explicit game domains where Zertalious cheats operate. It CANNOT see, inspect, or modify any other web page (such as your email, banking, social media, or search engines).
3. Why We DO NOT Request "webRequest" or "declarativeNetRequest":
Network interception APIs can monitor raw HTTP traffic and slow down browsing. AntiZert does not intercept raw network packets. Instead, it performs lightweight URL parameter substitution and client-side ASCII byte decoding at `document_start`, executing in less than 2 milliseconds.
4. Why "storage" Cannot Be Removed:
Without `"storage"`, any setting toggled in the popup (like turning off popups or resetting your stats) would reset every time the browser or tab closes. Storage is the standard, safest method in Manifest V3 to remember your preferences locally.
================================================================================
4. DATA SECURITY & CHILD SAFETY COMPLIANCE
================================================================================
AntiZert is suitable for users of all ages:
• We do not target, collect, or store information from children or adults.
• The extension contains no chat rooms, social integrations, or external forms.
• All operations remain restricted to local DOM adjustments on the designated game URLs.
================================================================================
5. USER RIGHTS & HOW TO REMOVE DATA
================================================================================
• Instant Reset: You can reset your accumulated bypass counters at any time by opening the extension popup and clicking the "Reset" button.
• Total Removal: If you choose to uninstall AntiZert from `chrome://extensions`, all locally stored preferences and metrics are permanently wiped by Chrome immediately.
================================================================================
6. CONTACT & INQUIRIES
================================================================================
If you have technical inquiries or feedback regarding this Privacy Policy, please open a support inquiry through the official extension listing on the Chrome Web Store.