Last updated: August 6, 2026

This privacy policy explains how the Statable GDPR Checker browser extension ("the extension") handles information. Statable GDPR Checker is an auditing tool published by Key Arg B.V. for Chrome and Firefox. We are committed to the same privacy-first approach as our analytics service: all processing described below happens locally in your browser, the extension makes no network requests of its own, and the information it reads never leaves your device.

Both browser builds read the same information and handle it the same way, so this policy applies to each of them; where they differ, the difference is noted. The extension opens in the side panel on Chrome and in the sidebar on Firefox; this policy calls that surface "the panel".

This is a separate extension from the Statable Debugger (https://statable.com/legal/extension-privacy), which has its own policy. The two read different things: the Debugger inspects Statable's own script, while the GDPR Checker observes what a page loads from third parties. If you use both, each policy applies to its own extension.

The canonical version of this policy is published at https://statable.com/legal/gdpr-checker-privacy

1. Who We Are

Statable GDPR Checker is developed and published by Key Arg B.V., a company registered in the Netherlands (KvK 89388496, Herckenrathstraat 1, 2681 DG Monster), and Key Arg B.V. is responsible for it. Because the extension transmits nothing, we never receive, store or decide what happens to anything it reads: that processing takes place on your device, under your control, and ends there. Key Arg B.V. is a data controller only for personal data you send us directly — an email to the address below, for instance — and for the statable.com website and analytics service. This policy is governed by the laws of the Netherlands. You can contact us at scanner@statable.com. Full company contact details are available in our main Privacy Policy at https://statable.com/privacy

1. Single Purpose

Statable GDPR Checker has one purpose: it measures what a website loads before the visitor answers its cookie banner, and reports which third parties received data and which cookies were stored. It is a measurement tool. It reports what a page did; whether that is lawful depends on context the extension cannot see, and nothing it shows is legal advice.

1. Scope Of This Policy

This policy covers the browser extension only. Our website and analytics service are covered by our main Privacy Policy at https://statable.com/privacy. Using the extension requires no Statable account, and the extension is not connected to any account you may hold with us.

1. Information The Extension Reads

The extension observes the http and https pages you visit while it is enabled. That observation is the measurement: there is no way to report which third parties a page contacted without watching the page contact them. Everything it reads is processed locally on your device and shown only in the panel.

The two stores ask different questions, which is why the answers differ. Chrome requires the categories "Website content", "Web history" and "User activity" to be disclosed even when the data never leaves the device, and the Chrome Web Store listing declares them. Mozilla defines data collection as handling data outside the add-on or the local browser, so the Firefox build declares no data collection at all in its manifest ("data_collection_permissions": {"required": ["none"]}) and Firefox shows "no data collected" when you install it. Because the extension transmits nothing, no separate consent step is required or presented. Both statements describe the same behaviour: everything below is read and discarded inside your browser.

For each page you load, the extension reads:

• the network requests the page makes: the URL and the timestamp of each request, which is what identifies the third parties involved and when they were contacted;
• one request header, and only on requests to Google measurement endpoints: whether a Cookie header was present. That single fact distinguishes a request carrying an identifier from a cookieless one, which is the difference between two verdicts. The header value itself is never read or retained;
• response headers, specifically Set-Cookie and its Path, Domain, Max-Age and Expires attributes, the headers that identify a CDN, and the status code of the main document, which is how a bot-protection wall is recognised — a persistent cross-site cookie and a load balancer's session cookie are different findings and can only be told apart by their attributes;
• cookies present for the page, read through the browser's cookie API: name, domain, path and expiry, and whether the cookie expires with the session. The extension never writes, edits or deletes a cookie;
• navigation events for the tab, which mark the moment the page began loading — the point from which "before consent" is counted;
• a copy of the page's HTML, up to 500,000 characters, taken once the page has loaded and matched locally against the signature list to find consent banners and tracking snippets that are present in the markup. The copy is matched and discarded in memory; it is not stored, never read for any other purpose, and no part of it leaves the browser;
• the page's consent banner, if it has one, found by looking for the elements, page-level variables and script sources that known consent tools install — the extension watches the page for these for the first fifteen seconds, because most banners appear after the initial markup; and
• the fact that you first interacted with the page — a click, key press or touch. Only the timestamp is recorded, because that moment is the boundary the whole measurement depends on: it separates what the page loaded on its own from what it loaded after you interacted with it. What you clicked, typed or entered is not read.

When you open the panel, the extension additionally reads the id and URL of the active tab, and whether that tab is a private one, so a measurement is attributed to the site it actually came from. On your instruction it can also act on tabs: reload the current one so the measurement starts at the first millisecond of the load, open a new tab at a site you type in, and open the current address in a new private window for a clean check.

1. How Each Type Of Information Is Used

Every item in section 4 is used for one thing: producing the reading you see in the panel. Request URLs are matched against the signature list to name the vendor; timestamps decide whether something happened before or after your first interaction; cookie attributes decide whether a cookie is a cross-site identifier or infrastructure; the HTML copy finds banners and snippets the network cannot reveal.

None of it is used to profile you, and none of it is used to build a record of the sites you visit. There is no such record: the extension keeps a measurement in memory for the tab it belongs to and nothing beyond it.

1. Information We Do Not Collect

The extension does not read or collect:

• what you type — only that an interaction occurred, and when. Anything you enter stays in the live page and is not part of the HTML copy described in section 4, which carries the markup the server sent and is matched against the signature list without being read for anything else;
• credentials, passwords, payment details or anything you enter on a page;
• your browsing history as a history — it observes the page currently open and keeps nothing after that tab is gone;
• the values of cookies, which are irrelevant to the measurement; only names, domains and attributes are read; and
• any identifier of you or your device. The extension creates no user id, installation id or device fingerprint.
• Sharing And Disclosure

Nothing is shared, because nothing is transmitted. The extension makes no network requests of its own — not to Statable, not to any third party, not for analytics, error reporting or updates to its signature list, which ships inside the package. No human at Key Arg B.V. or anywhere else can access what the extension reads, because it is never sent anywhere. We sell nothing to anyone, for the simple reason that we hold nothing to sell.

1. Store Policies

Chrome. Statable GDPR Checker's use of information received from browser APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. The information described in section 4 is used solely to provide the measurement shown in the panel. It is not transferred, not sold, not used for advertising, creditworthiness or lending purposes, and not used to train any model.

Firefox. The extension transmits no data, so Mozilla's data collection and transmission requirements are satisfied by design: the manifest declares no data collection, Firefox states that at install, and there is no consent step to present because there is nothing to consent to.

1. Data Retention

A measurement lives in the browser's memory for as long as its tab does. Navigating to another page starts a new measurement and discards the previous one; closing the tab, or restarting the browser, discards it entirely. The extension writes nothing to disk: it uses no extension storage, no cookies of its own and no local database. There is no server to delete anything from, and no account, profile or record held by us — so there is nothing for us to give you access to, correct or erase. Your rights over data held by Statable's website and analytics service are covered by our main Privacy Policy at https://statable.com/privacy

1. Data Security

The strongest security property of this extension is what it does not do: it never transmits data over the network, so there is no data in transit to protect. All processing takes place inside your browser on your own device, and the information is discarded as described in section 9.

1. Private Browsing And Incognito Access

The extension can ask for permission to run in private or incognito windows, which both browsers disable for extensions by default and which you grant explicitly — "Run in Private Windows" in Firefox, "Allow in Incognito" in Chrome. It asks for one reason: a site you have already accepted cookies on may not show its banner again, which makes the reading unreliable. A private window carries none of that history. Everything in this policy applies identically there, and no data from a private session is stored: the extension writes nothing to disk in any window, and the in-memory measurement is discarded when the window closes.

1. Remote Code

The extension is self-contained and does not load remote code for execution. It is built on Manifest V3, and all of its code — including the signature list that identifies trackers — is bundled into the extension package reviewed by the store it is distributed through.

1. Changes To This Policy

If we change what the extension reads, how that information is used, or any other data practice described here, we will update this policy, revise the "Last updated" date above, and proactively notify users of material changes through the extension's store listings before the new practices take effect.

1. Contact Us

If you have questions about this policy or the extension's data practices, contact us at scanner@statable.com. General enquiries can go to support@statable.com. Full company contact details, including our postal address, are available in our main Privacy Policy at https://statable.com/privacy