Privacy Policy
Effective date: July 29, 2026
My Two Cents ("My Two Cents", "we", "us") provides a browser extension and companion web app that let people comment and vote on any web page. This policy explains what data the extension and web app collect, why, and how it's handled.
1. What the extension does NOT do
- It does not read, scan, or transmit the content of the pages you visit. The content script only reads the page's URL (to know what thread to load) and the hostname (to check your per-site enable/disable setting). It never reads page text, forms, DOM content, or anything you type outside its own comment box.
- It does not track your browsing history. Nothing is recorded about pages you visit unless you actively open the panel or a badge count is fetched for the active tab.
- It does not sell or share your data with advertisers or data brokers.
- It does not inject ads or modify the content of the pages you visit — its UI is rendered inside an isolated shadow DOM that page scripts cannot read or alter, and that cannot alter the page around it.
2. What data we collect and why
| Data | Why we collect it | Where it's stored |
|---|---|---|
| Page URL (current tab) | To look up and display the comment thread for that page, and to show a comment-count badge | Sent to our API per request; not stored by the extension beyond an on-device hash used to remember panel position/state (see §3) |
| Account info (display name, handle, avatar/moderator/verified badge) | To show who posted a comment and let you manage your profile | Stored on our servers, tied to your account |
| Comments, replies, and votes you post | This is the product — public discussion content | Stored on our servers, publicly visible on the relevant page's thread |
| Authentication tokens (access + refresh) | To keep you signed in | Access token in chrome.storage.session (cleared when the browser closes); refresh token in chrome.storage.local (persists so you're not signed out on every restart). Never exposed to page scripts. |
| Per-site enable/disable choice | So the extension can stay off on sites where you've turned it off | chrome.storage.sync (syncs across your signed-in Chrome browsers), keyed by hostname only |
| Panel position, size, and open/closed state per page | Convenience — restores the panel where you left it | chrome.storage.local, keyed by a non-reversible hash of the page URL, not the URL itself |
| Notifications (someone replied to or upvoted your comment) | To alert you to activity on your comments | Fetched from our servers on demand; not persisted by the extension beyond an unread count |
| Install and share-link-click events | Basic product analytics (e.g. install counts, share button usage) | Sent to our servers; no page content or browsing history attached |
3. Authentication
Signing in uses OAuth (Google or GitHub) via chrome.identity.launchWebAuthFlow, which hands the flow to Chrome's own browser-controlled sign-in window. We never see or store your Google/GitHub password — only the identity token our own auth server issues after the provider confirms who you are.
4. Data sharing
We do not sell personal data. We do not share your data with third parties except:
- The OAuth provider you choose to sign in with (Google or GitHub), solely to authenticate you.
- Infrastructure providers (e.g. our cloud host and database provider) who process data on our behalf to run the service, under standard hosting agreements.
5. Data retention and deletion
- Comments and votes are retained until you delete them or delete your account.
- Auth tokens are cleared immediately on sign-out.
- You can revoke the extension's access to specific sites at any time from
chrome://extensions→ My Two Cents → Site access, or by turning off the per-site toggle in the extension popup. - To request deletion of your account and associated data, contact us at the email below.
6. Children's privacy
My Two Cents is not directed at children under 13, and we do not knowingly collect data from them.
7. Security
Authentication tokens are kept in extension-isolated storage (chrome.storage.session / chrome.storage.local), which page JavaScript cannot read. The extension's UI runs inside a closed shadow root, which page scripts cannot access either.
8. Changes to this policy
We'll update the effective date above if this policy changes, and post material changes to the extension's Chrome Web Store listing.