Ape Law VASP Verify
Privacy and browser permissions
What the Chrome and Firefox extensions can access, what stays on the device and what an update request reveals.
Privacy summary
The version 1.0.0 extension matches website hostnames locally. It has no account system, advertising, profiling, analytics SDK or sale of extension activity. It downloads public tracker data from a fixed Ape Law URL where browser permissions allow.
Declared permissions
| Permission | Browser | Why it is requested |
|---|---|---|
tabs | Chrome and Firefox | Reads the active tab URL and responds when tabs are activated or updated so the extension can extract the hostname locally. |
activeTab | Chrome and Firefox | Declared in version 1.0.0 for active-tab access. The extension does not inject code into page content; permanent tabs access already supplies the URL used by the matcher. |
storage | Chrome and Firefox | Stores the selected public domain index, its source, a local fetch timestamp and the last refresh error on the device. It does not store checked hostnames or browsing history. |
alarms | Chrome and Firefox | Ensures an approximately daily data-refresh alarm exists; a newly created alarm first triggers after five minutes. |
https://tracker.ape.law/* | Chrome and Firefox host access | Allows requests to Ape Law's fixed public dataset endpoint. The request does not include the active hostname. |
technicalAndInteraction | Firefox optional control | A user-facing optional setting in the Firefox build. When disabled, remote refresh is blocked and the bundled snapshot is used. |
What stays on the device
The active tab URL is read by the extension and its hostname is normalised and compared on the device. Checked hostnames and browsing history are not placed in the dataset URL, request body or extension storage. The local cache contains the selected public domain index, its source, a local fetch timestamp and the last refresh error. Firefox's optional technical-data grant is managed by Firefox and is not stored as an extension preference.
What is downloaded
The extension can request the public VASP domain index. It contains reviewed domains, entity and authorisation records, public evidence links, source permission lines, Ape Law activity labels and publication metadata. Chrome can make this request automatically; Firefox does so only with its optional technical-data permission.
Ordinary hosting information
Even though the active hostname is not transmitted, an ordinary request to tracker.ape.law can reveal an IP address, browser and network metadata, request timestamp and the fixed requested data-file path to Ape Law's hosting and infrastructure providers. Those providers may retain ordinary security and access logs under their practices.
Analytics, advertising and profiling
The extension runtime contains no analytics, advertising or profiling code. The tracker, extension landing page and this documentation use the project's existing Google Analytics and Microsoft Clarity configuration on the public website. The formal extension privacy notice is intentionally analytics-free.
Retention and removal
Extension cache data remains in browser-managed extension storage until it is replaced, cleared or the extension is removed. Uninstalling VASP Verify deletes that browser-managed extension data. It does not retroactively remove hosting-provider access logs or data governed by a linked regulator or third-party website.
Outbound links
Selecting an official regulator, business website, tracker or Ape Law link opens that destination normally. The destination then receives the ordinary request information associated with visiting its site and applies its own privacy terms.