Privacy Policy
Last updated 12 October 2026
LeadScout is a Chrome extension and web app that helps freelancers find businesses that may need their services. This policy describes exactly what it reads, what leaves your browser, what is stored, and how to delete it.
It is written against what the software actually does. If you find a discrepancy, treat it as a bug and tell us.
- We do not collect your browsing history.
- We read no page except a Google search results page you are already viewing.
- Nothing about a business is sent to our server unless you click Analyze or Save.
- We do not sell data, and we run no advertising or third-party analytics trackers.
- You can delete everything from Settings → Delete my data.
What the extension reads in your browser
The extension runs on Google search result pages only — google.com/search and
the country equivalents listed in its manifest. It has no access to any other website you
visit.
On those pages it reads what is already displayed: business names, links, snippets, and any
star rating or review count Google rendered. This happens locally in your browser. Results
are held in chrome.storage.session, which Chrome clears when the tab closes or
the browser exits.
On a search that looks like local prospecting, the extension may show a small “prospects found” button on the results page so you can open the panel. It reads nothing beyond the results described above, and you can turn it off in Settings.
The extension requests the sidePanel, storage,
contextMenus and alarms permissions, plus network access to our
own API domain. It does not request access to all websites. contextMenus adds
“Analyze this website with LeadScout” to the right-click menu; the extension learns the
address of a page or link only when you choose that item. alarms lets it check
your own saved leads for follow-ups that are due, a few times a day, only while you have
leads marked Contacted.
What is sent to our server
Nothing is transmitted until you act.
When you click Analyze
We send the business's website address, its name, and any rating or review count shown on
the results page. Our server then requests that business's public homepage — the same page
anyone can visit — and records structured facts about it: whether it uses HTTPS, whether it
declares a mobile viewport, whether it has a booking link, page title length, and similar.
We do not store the page's full HTML. We check the site's robots.txt first and
do not fetch it if crawling is disallowed. If our server cannot read the public homepage,
it may send that homepage address to Firecrawl to retrieve the page. Firecrawl is used only
as a fallback for an analysis you requested. The returned page is measured by the same
rules, and we ask Firecrawl not to store the result in its cache.
Among those facts are the contact details the business itself publishes as links on its
homepage — email addresses in mailto: links, phone numbers in
tel: links, and the address of its contact page — so you can see how to reach
it. We do not collect contact details from anywhere else.
The same applies when you choose Analyze this website from the right-click menu or type an address into the panel or the web app: we receive the address you chose, and nothing else about the page you were on.
When you click Save
We store the business name, domain, address, the rating and review count shown on the results page, and the search query the lead came from.
When you draft outreach
Template drafts are written in your browser and sent nowhere. When you ask for an AI rewrite, the structured observations from the analysis — not the web page, and not your browsing data — are sent to Cloudflare Workers AI to be phrased into a message, along with the name you sign with, if you entered one.
When you create an account
We store your email address and a cryptographic hash of your password. We never store your password itself and cannot recover it.
What we store
| Data | Why | Retention |
|---|---|---|
| A random installation ID | Identifies your account without requiring signup | Until you delete your data |
| Email address and password hash | Signing in from the web app | Until you delete your data |
| Session tokens (hashed) and when each was last used, to the hour | Keeps you signed in; counts how many people use LeadScout each week | Expire 15–30 days after last use |
| Saved leads and notes | Your pipeline | Until you delete them |
| Service profile, your prices, and the name and portfolio link you sign with | Weights findings; calculates project value; signs your drafts | Until you delete your data |
| Usage counts | Enforces plan limits | Rolling monthly counters |
| Subscription status and Lemon Squeezy IDs | Grants the plan you paid for | Life of the subscription |
| Website analyses | Avoids re-fetching the same public site | 7 days, then re-fetched |
| Password reset tokens (hashed) | Lets you regain access | 1 hour, single use |
| A salted hash of your IP address | Rate-limits account creation and feedback | Deleted after 1 hour |
| Uninstall feedback you choose to send | Tells us what to fix | Kept, not linked to any account |
Your IP address is never stored in readable form. Only a salted SHA-256 hash is kept, and only for one hour, to stop automated abuse of the signup endpoint.
Website analyses are cached against the website's address, not against you, and are shared between users. They contain only facts about a public website.
Stored only in your browser
Businesses you Skip are remembered in your browser's local storage and are never sent to our server. Skipping is a judgement about your own time, not data about the business. So are your display preferences, the date you installed the extension, and simple counts of how many analyses, drafts and saves you have made, which decide when the extension asks — once — whether you would rate it.
If you uninstall
Chrome opens a short page asking why. Answering is optional. If you do, we store the reason you pick, any comment you type, the extension version and the date it was installed. None of it is linked to your account, and a salted hash of your IP address is kept for one hour only to stop spam.
What we never collect
- Browsing history, or any list of sites you have visited
- The content of pages other than the Google results page you are viewing
- Keystrokes, form contents, passwords or cookies from sites you visit
- Personal data about the customers of the businesses you research
Third parties
- Cloudflare hosts our API, database and AI models. Data is processed on Cloudflare's network. Cloudflare's documentation states that inputs to Workers AI are not used to train its models.
- Firecrawl may retrieve a business's public homepage when our direct request fails. It receives that public URL and processes the page content needed to return it. It does not receive your Google search query, saved notes, account password or browsing history from LeadScout. We disable Firecrawl result caching for these requests; Firecrawl's own service and security terms still apply to its processing.
- Lemon Squeezy processes payments if you subscribe. They receive your email and payment details directly; we never see your card details. They send us your subscription status and the email you checked out with.
- Our email provider delivers account emails such as password resets, and receives your email address for that purpose only.
We do not sell data, and we do not run advertising or third-party analytics trackers.
Limited use
Our use of information received from Google APIs and from pages you view adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the features described here, is never sold, and is never used for advertising or profiling.
Your control
- Delete a lead — Saved tab → Remove, or Leads → Remove in the web app.
- Delete everything — Settings → Delete my data. This erases your account, saved leads, notes, service profile, usage records and subscription record. It cannot be undone. Cached analyses of public websites are not deleted, because they contain nothing about you.
- Stop the on-page button — Settings → On Google results.
- Stop all data collection — uninstall the extension.
Businesses you research
LeadScout reads publicly available information about businesses — their public website and what Google displays about them. If a business asks you to delete information you have stored about them, remove the lead from your Saved list, or contact us and we will remove it.
Children
LeadScout is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.
Contact
Questions or deletion requests: neetpav46@gmail.com
Changes
If this policy changes materially, the extension will show the change before continuing to send data under the new terms.