Waiex Privacy Policy

In short

Waiex blocks and delays distracting websites. To do that it has to see which page you are opening — but that information stays on your computer. Your blocked-site list, your statistics and your settings are never uploaded.

What does leave your computer is listed below, in full. There is no analytics SDK, no advertising network and no third-party tracker in this extension.

What stays on your device

All of the following is held in chrome.storage on your own machine, and in your Chrome Sync profile if you have sync enabled:

• The list of websites and categories you chose to block
• Your statistics — blocked attempts, visits, and time spent per site
• Settings: wait interval, active hours, difficulty profile, theme, custom images
• The result of on-page category analysis (for example “this domain looks like a news site”), cached so the page is not re-analysed

None of this is sent to me or to anyone else. If you uninstall the extension, it is deleted with it. You can erase your statistics at any time from the dashboard with Delete all data.

What is sent to bangelov.dev

A random device identifier

On installation the extension generates a random identifier (crypto.randomUUID(), for example 550e8400-e29b-41d4-a716-446655440000). It is not derived from your hardware, your browser or you, and it cannot be traced back to you.

This identifier is sent to bangelov.dev roughly once a day to ask whether your copy is licensed or still within its free trial. I store it with the date it was first seen, so the trial cannot be reset by reinstalling. No browsing data accompanies this request.

Your account, if you create one

Premium is tied to an account rather than to one browser, so a single purchase works everywhere you sign in. Creating one is optional: the free tier and the trial work without it, and the extension never asks you to sign in to keep using them.

If you do create one, I store your email address, whether you have confirmed it, and which sign-in method you used. Passwords are handled by Google Firebase Authentication and never reach my servers — I cannot see your password, and neither a mistake nor a breach on my side could expose it. If you sign in with Google instead, Google tells me your email address and an identifier for your account, and nothing else: no contacts, no Drive, no profile beyond your name and address.

Alongside the account I store the device identifiers signed in to it, a label you can recognise (such as “Chrome · Windows”) and when each was last used — so the account page can show you a list you can actually act on, and so the ten-device limit can be enforced. You can remove any of them at any time.

The extension never sends your blocked sites, your statistics or your settings to the account. Those stay on your computer, signed in or not.

Your email address, only if you offer it

• If you buy Premium: payment is handled entirely by Stripe. I never see your card details. Stripe passes me the email address you used at checkout, so the purchase can be matched to your account and a receipt sent to you.
• If you claim the free student licence: your university address (@tum.de or @ethz.ch) is sent so a verification code can be emailed to it. The address and code are deleted once verification succeeds, and expire automatically after 15 minutes.

Feedback you choose to submit

The optional feedback form sends only what you typed into it, plus your device identifier so the trial extension can be credited. It is never sent automatically.

What is sent to third parties

Being precise about this matters more than sounding good, so:

• Google (favicons). The dashboard shows each site’s icon using google.com/s2/favicons. This means the domain names on your blocked list are visible to Google when you open the dashboard. No identifier of yours is attached, but if that bothers you, it is the one call worth knowing about.
• Google and worldtimeapi.org (clock). The extension asks these for the current time. Your difficulty locks are enforced against network time rather than your computer’s clock, so that moving the system clock forward cannot unlock a setting early. These requests contain no data about you.
• Google Firebase Authentication. Verifies your email address and password if you create an account, and sends the confirmation and password-reset emails. Google receives your email address and password for that purpose, under its own privacy terms. It is not used if you never create an account.
• Stripe. Handles payment if you buy Premium, under its own privacy policy.
• Cloudflare. Hosts bangelov.dev and its database, and like any web server records standard request logs.

Share buttons open X, LinkedIn or WhatsApp in a new tab with text you can read and edit first. Nothing is posted on your behalf.

Why the permissions are so broad

Waiex requests access to all websites (<all_urls>). That is a wide permission and you are right to ask why.

• You can block any site, so the extension cannot know in advance which addresses it needs to watch. It has to be able to check every navigation against your list.
• Category blocking (social, news, betting and so on) recognises thousands of well-known sites instantly. For a site it does not recognise, it reads that page’s title and meta description to guess the category. That analysis happens inside your browser, and only the resulting category is kept. The page text is never transmitted.
• Page content is only examined when you have category blocking switched on.

The remaining permissions are narrower: storage for your settings, tabs and webNavigation to notice when you open a page, scripting for the category check above, idle so that time away from the keyboard is not counted against you, alarms for time tracking and the daily licence check, and favicon for site icons.

Your rights

I am based in Germany, so the GDPR applies. You may ask what is stored about you, ask for it to be corrected, or ask for it to be deleted.

In practice the only records tied to you are your device identifiers, your account (email address, which devices are signed in to it, and your licence if you have one), and any address used for student verification. You can delete your account yourself, from the account page, at any time and without asking me.

Deleting it does not destroy a purchase. If you own a Premium licence, a claim code is emailed to you before anything is removed, and entering that code on a new account restores it. That email is sent once and cannot be reissued.

Your password is not mine to delete or disclose: it is held by Firebase, and I never receive it.

Uninstalling removes everything held on your device immediately.

Changes

If this policy changes in a way that affects what is collected, the date at the top will change and the update will be noted on the extension’s store listing.

Contact

Questions about any of the above, or a deletion request: get in touch.