ReadyRank Privacy Policy
**Status: written for v0.9.1 — published at the project homepage:
ReadyRank is a Chrome extension for website owners to audit their own pages.
This draft describes, in plain language, exactly what the extension does and
does not do with data.
1. What ReadyRank does NOT do
- No accounts, no sign-in, no usage tracking or analytics. ReadyRank
contains no telemetry, no third-party scripts, and no remote code.
- **No data is ever uploaded from your computer except public web pages the
website scan fetches** (see §3). Scanned page content, scan results, history
and settings never leave the device.
- No cookies, credentials or form input values are read. Collection walks
visible text elements (p, headings, li, etc.), images, links and metadata
— input/textarea values are not read, and every fetch runs with
credentials: "omit" so no cookies or auth headers are sent.
- No claims about monetization outcomes. ReadyRank reports measurable risk
signals and explicitly does not predict AdSense or any program's approval.
2. Local processing
All analysis runs inside the extension on your machine: deterministic rules are
JSON files bundled in the package, engines are plain JavaScript functions. The
extension never sends page text, URLs, findings or scores to any server the
user does not explicitly ask ReadyRank to fetch (see §3).
MV3 content security policy forbids remote code; there are no obfuscated
scripts and no eval/Function anywhere in the codebase.
3. Network activity — exactly when, and what is fetched
ReadyRank performs zero automatic network calls. The only requests happen
when the user clicks "Scan" / "Scan Website" ("Complete mode" runs the
same requests in resumable chunks), which then issues GET requests, without
cookies or authentication (credentials: "omit"):
— once per site (10 s timeout, 400 KB cap)/robots.txt — once per site (same limits); only presence and the/ads.txt
publisher ID line are parsed
or the sitemap URLs declared in robots.txt — up/sitemap.xml
to 10 sitemap documents, indexes expanded one level deep
- Same-origin
http(s)pages during a user-started site scan — visited in one
dedicated unfocused crawl window the extension opens (a visible window,
not the user's active tab, so hydration is not throttled but focus is never
stolen), exactly as a first-time visitor would see the rendered DOM
(React/Next.js sites serve an empty a static parse would misread a 2000-word article as "138 words" — a real regression found on a live site). Pages that cannot render fall back to a raw-HTML fetch parsed in a private offscreen document (1.5 MB cap each). Pacing is polite: base delay per mode, robots circuit-breaker, wall-clock budget per run: - Quick: up to 5 pages · Deep: up to 25 · Full: up to 120 - Complete: every eligible discovered page, one by one, in resumable chunks (capped at 600 analyzed pages per scan; coverage gaps are labeled honestly) page URL — fetched with HEAD-style text limits to detect broken navigation (SITE007). Same-origin only, same pacing. ICANN bootstrap resolver, for the domain registration-age check (AADS011). Only the scanned hostname is sent. Robots rules are enforced ( is strictly same-origin, and junk paths (search/login/cart/wp-*/page/N) are excluded. No request ever goes to a ReadyRank-operated server — there is none. Storage keys actually used by the extension: Everything listed is stored in logs into Chrome with sync enabled for extensions (Chrome behavior, not ours). ReadyRank is a website-owner utility, not a children's application. Store listing category: Developer Tools / Productivity. Support contact: — public repo issue tracker. ReadyRank is not affiliated with, endorsed by, or sponsored by Google LLC. Android, Chrome and AdSense are trademarks of Google LLC. ReadyRank's rules reflect publicly available quality guidelines only; it neither can nor should predict monetization outcomes.Crawl-delay honored, errorhttps://rdap.org/domain/ — one request per site scan, to the publicDisallow checks + crawl-delay pacing), the crawl4. Chrome permissions and why each is needed
Permission Why Boundaries activeTabScan the page the user is on when clicking the toolbar icon Granted per-click; revoked on navigation scriptingRe-inject the read-only signal collector into a page in the crawl window if its content script is missing (rare CSP cases) Only the crawl window's tabs storage + unlimitedStorageSettings, last scans, 20-entry history, resumable Complete-mode checkpoints — all on-device unlimitedStorage only raises the DEVICE-LOCAL quota (a 600-page Complete report is multi-MB); nothing ever leaves the machineoffscreenA hidden document to run DOMParser on raw HTML fetched during user-initiated site scans (service workers have no DOM)Lives only during a site scan; never displays, never persists HTML Host permissions http://*/*, https://*/*A website crawler must fetch robots.txt/sitemaps/ads.txt, open site pages in its crawl window to read their RENDERED content (§3 item 4) and probe same-origin links — all for the site the user explicitly asked to scan Requests go ONLY to the scanned site's own origin (+ rdap.org for domain age). No other origin is ever contacted; content never leaves the device 5. Stored data (device-local)
Key Content readyrank_last_scansanitized page scan (counts, structure, findings) readyrank_last_site_scansanitized site scan report readyrank_last_progresslatest single progress event readyrank_scan_historylast 20 compact entries: kind, URL/domain, score, issue count readyrank_flagsonboarding/first-scan dismissed flags readyrank_optionsuser settings (scan defaults) readyrank_chunk_*transient Complete-mode checkpoint for a running scan (device-local; swept automatically at browser start) cleared when the scan finishes readyrank_crawl_tab (session)ids of the temporary crawl window/tab used while a rendered site scan runs removed the moment the scan ends chrome.storage.local, synced only if the user6. Children, policy, contact
7. Disclaimer