Does SiteScore collect, track, or sell my browsing history?

No. SiteScore operates under a strict zero-telemetry default profile. All webpage DOM inspections, SEO forensic audits, AEO direct answer checks, and schema validations execute 100% locally on your machine. We do not track, collect, or monetize your browsing history or audit targets.

Where are my OpenAI and Moz API keys stored?

If you choose to configure external API keys in SiteScore settings, they are stored strictly on your local device using chrome.storage.local. They are never transmitted to Trustoryx servers and are only used for direct HTTPS requests between your browser and the respective API providers.

How does SiteScore protect against Server-Side Request Forgery (SSRF)?

SiteScore enforces strict client-side network sanitization. The internal crawler rejects all attempts to probe localhost, 127.0.0.0/8, RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), IPv6 loopback, and cloud metadata endpoints (169.254.169.254).

Can I permanently wipe all data stored by SiteScore?

Yes. You can instantly wipe all API keys, custom strategies, audit histories, and crawler databases by clicking "Reset All Extension Data" in the extension Preferences. Furthermore, uninstalling SiteScore immediately removes all local storage from your device.

Back to All Privacy PoliciesDOC-ID: PRIV-SITESCORE-MV3

Google Chrome Web Store & Manifest V3 Certified

SiteScore Privacy Policy.

Complete disclosure of our 100% local-first diagnostic engine, zero-telemetry architecture, cryptographic privacy boundaries, and Google Chrome Web Store compliance.

SiteScore v3.0.0 (Manifest V3)

Effective Date: October 2026Last Updated: October 2026

Section 01

Core Commitment & Zero-Telemetry Profile

At Trustoryx Intelligence(“Trustoryx”, “we”, “us”, or “our”), we engineer security-focused developer and web forensic tools that respect your digital sovereignty. SiteScore — SEO, AEO & GEO Analyzer (v3.0.0) is distributed as an unpacked and Chrome Web Store extension designed for webmasters, developers, search specialists, and digital agencies.

No Tracking Servers or Background Analytics

SiteScore embeds no external telemetry beacons, no Google Analytics, no Mixpanel, no Segment, and no Sentry tracking SDKs. When you inspect an active website or run deep link crawlers, your scan queries, DOM snapshots, and browsing history are never transmitted to Trustoryx servers.

Section 02

Data Handled & Storage Boundaries

We uphold data minimization principles. Below is a complete classification of all information classes handled by SiteScore:

A. Webpage DOM & Metadata

Content Processed:Title tags, meta descriptions, canonical URLs, robots directives, Open Graph, Twitter cards, heading tags (H1–H6), schema markup (JSON-LD), link anchors, and performance navigation timings.

Boundary: Inspected strictly in ephemeral browser memory. Content is discarded as soon as you close or switch the tab.

B. User API Keys & Credentials

Optional Keys: OpenAI API keys (for AI Fix Tips and Voice of AI summaries) and Moz API keys (for Domain Authority benchmarks).

Boundary: Stored strictly on your client machine using encrypted chrome.storage.local. Never uploaded to Trustoryx servers.

C. Site Spider & Crawler History

Crawling Data: Internal link URLs, HTTP response status codes (e.g., 200, 301, 404), latency response times, and broken redirect chains.

Boundary:Persisted inside your browser’s IndexedDB / local storage database. Zero crawl traces or target URLs are relayed externally.

D. Sensitive Element Exclusion

Non-Inspected Data: Form fields marked as type="password", session cookies, local auth tokens, and financial inputs are strictly ignored by content scripts.

Boundary: Hardcoded exclusion filters in the DOM parser protect all confidential user credentials.

Section 03

Chrome Extension Permissions Justification

In accordance with the Google Chrome Web Store Least Privilege Policy, SiteScore requests only the permissions strictly required to execute its declared diagnostic and auditing capabilities:

activeTabLow Risk

Used to inspect the DOM, meta elements, and headings of the currently focused tab only when invoked by the user via the extension popup or side panel. Avoids excessive background access.

scriptingLow Risk

Enables safe programmatic injection of measurement probes to observe Core Web Vitals (LCP, CLS, INP) and extract schema structures.

sidePanelLow Risk

Renders the persistent 18-tab diagnostic side panel interface in Google Chrome, allowing real-time audits side-by-side with browsing.

storageLow Risk

Saves audit snapshots, competitor benchmark targets, custom fix planner tasks, and extension preferences locally in chrome.storage.local.

webNavigationLow Risk

Detects Single Page Application (SPA) URL changes on the active tab so audits can seamlessly synchronize with active route transitions.

clipboardWriteLow Risk

Permits 1-click copying of generated Schema.org JSON-LD blocks, meta tag templates, and suggested remediation code snippets directly to your clipboard.

downloadsLow Risk

Permits exporting comprehensive audit reports in JSON, CSV, PDF, or HTML format directly into your operating system's default Downloads directory.

alarmsLow Risk

Manages crawler timeout prevention, background keepalive during deep audits, and periodic cache eviction routines.

<all_urls> (Host Permissions)Medium (Audited) Risk

Required to ping internal website links to detect 404 broken links, verify RFC 9309 robots.txt rules, inspect /llms.txt discovery endpoints, and assess SSL certificate parameters across inspected domains.

Section 04

Defense-in-Depth Security Architecture

SiteScore enforces robust client-side protections to ensure that analyzing third-party websites never compromises your browser security or local network:

SSRF & Private Network Guard

Our crawler strictly denies requests to localhost, IPv4 loopback (127.0.0.0/8), RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), IPv6 loopback (::1), and AWS/GCP cloud metadata services (169.254.169.254).

CSV Formula Injection Defense

Exported CSV files automatically sanitize cells starting with =, +, -, @, \t, \rby prefixing a single quote (') to neutralize dynamic formula execution (DDE) in Microsoft Excel and Google Sheets.

XSS & DOM Sanitization

Inspected HTML strings undergo comprehensive sanitization before rendering in popup or side panel UI. Scripts, event handlers (onclick, onerror), and arbitrary iframe embeds are permanently stripped.

Zero Dynamic Code Execution

Manifest V3 Content Security Policy enforces script-src 'self'; object-src 'self'. No dynamic evaluation (eval(), new Function()) and no remote script loading.

Section 05

Optional Third-Party AI & Authority Integrations

SiteScore operates 100% autonomously without external accounts. However, users may optionally link their own third-party developer API keys for advanced intelligence:

OpenAI API (Optional)

Direct HTTPS

Used solely when you trigger “Voice of AI” executive summaries or AI-assisted Fix Tips. Requests are sent directly from your browser to OpenAI’s official API endpoints using your personal key. No intermediary Trustoryx proxy is involved.

Moz API (Optional)

Direct HTTPS

Used optionally for fetching real-time Domain Authority (DA) and Page Authority (PA) benchmark scores. Queries transmit only the active target domain directly to Moz services over HTTPS.

06. Chrome Web Store Single Purpose Declaration

In strict compliance with Google Chrome Web Store policies:

Single Purpose: SiteScore exists for the solitary purpose of providing “Website SEO, AEO, GEO, technical health, structured data, and accessibility diagnostics.”
Zero Remote Code: All JavaScript logic, icons, CSS styles, dictionaries, and heuristic scoring engines are 100% packaged locally inside the extension.
No Monetization of Personal Data: We never sell, lease, monetize, or transfer user browsing records to data brokers, ad networks, or marketing conglomerates.

Section 07

User Data Sovereignty & 1-Click Wiping

Under international privacy frameworks including the GDPR (EU), CCPA/CPRA (California), and DPDP Act 2023 (India), you retain absolute authority over all diagnostic records and cached data:

1-Click Factory Reset

Open SiteScore Options > Preferences > Danger Zone and click “Reset All Extension Data” to instantly wipe all API keys, benchmarks, cached audits, and crawler stores.

Complete Uninstallation

Removing the extension from Google Chrome immediately and permanently clears all associated chrome.storage.local and IndexedDB databases from your physical disk.

Statutory Inquiries

Because we do not maintain centralized user databases, we hold no PII to access or correct. For questions, contact our compliance team directly at [email protected].