Privacy Policy

Last updated 24 August 2026 · applies to the Justin Chrome extension and the optional Justin web app.

The short version

Justin has no server. It does not collect, transmit, sell or share your data, because there is nowhere for your data to go. Everything it stores lives in your own browser, on your own computer.

What Justin stores, and where

• Browsing time — how many seconds you spent on each site, per day, kept in the browser's local extension storage. Justin records the site's hostname (for example example.com), never the full URL, page contents, or what you did there.
• Daily limits — the sites you chose to cap and the minutes you allowed.
• Notes and screenshots — the text you type, and any tab screenshots you choose to save with the Screenshot button. Justin never takes a screenshot on its own.
• Saved logins — encrypted with AES-GCM under a key derived from your password (PBKDF2-SHA256, 200,000 iterations). Justin stores only the ciphertext. Your password itself is never stored, only a salted hash used to check it.
• Tab snapshots — an image of a tab taken as it is suspended, so the paused screen can show you the page. These are kept for the current browser session and discarded when the tab is resumed or closed, or when the browser restarts.
• Settings — your username, auto-suspend threshold, chart preference and timer default.

What leaves your machine

Nothing, unless you deliberately click something that opens a page:

• The Buy me a coffee button opens buymeacoffee.com in a normal tab.
• The Ask Claude buttons build a prompt from the note or the browsing figures you are looking at, put it on your clipboard, and open a new claude.ai tab with it. You can read it before sending, and nothing is sent if you close the tab.
• The website button opens the address you configured.

Justin makes no other network requests. It contains no analytics, no telemetry, no advertising, no tracking pixels and no third-party scripts of any kind.

The optional app

The Justin web app talks to the extension directly inside your browser, over Chrome's own extension messaging. It requires your password, sends only a one-way hash of it, and receives the vault still encrypted — decryption happens in the page, in memory. The app keeps a copy of your data in that browser's local storage so it works offline. No server is involved at any point. "Forget this device" clears that copy.

Your control

Everything Justin knows can be erased at any time: Forgot password — reset account in the extension wipes all of it, and removing the extension removes its storage with it. There is no account to close and no copy held anywhere else.

Password recovery

There is none, by design. Nobody — including the author — holds a copy of your password or a way to decrypt your vault without it. If you forget it, that data is gone.

Children

Justin is not directed at children and collects no information from anyone.

Changes

If this policy ever changes, the updated version will be posted on this page with a new date. Justin's design goal is that this policy stays boring.

Contact

Questions about this policy: hjrchoi0823@gmail.com