What we collect
Your account
An email address and password, handled by Supabase, our authentication provider. We never see your password in plain text — Supabase stores it hashed and BOOEE only ever receives a session token proving you're signed in.
Flagged-site activity
When you visit a site on your own blocked-sites list, or one on BOOEE's bundled default list of known adult sites, we log: the domain (for example, "example.com" — never the full page address), a one-way hash of the specific page visited (not reversible, and not the page's content), the time, and which option you chose — leave the site, contact a partner, lock your browsing, or continue anyway (continuing isn't available on sites from the bundled default list — see "Site and search filtering" below). If you answer the optional "what are you actually needing right now?" prompt, that one-word answer (e.g. "Comfort") is stored too — answering is always optional. Your dashboard's streak, "urges interrupted," and Trends figures are calculated entirely from this log, nothing separate.
Accountability partners
The name, and the email and/or phone number, of anyone you choose to add as a partner — plus your confirmation that you've already talked to them about it before adding them.
Bug reports
If you use the "Report a bug" button, we receive the message you write, the page you were on, and your account email, so we can look into it.
What we don't collect
- Your general browsing history. BOOEE only checks whether the current page matches a list or filter it's watching for — your own blocked-sites list, the bundled default list, Safe Search enforcement, or the explicit-keyword filter, all described below. Anything that doesn't match is never recorded, transmitted, or stored, in any form.
- The content of pages you visit.
- What you search for. Even when the keyword filter or Safe Search enforcement acts on a search, the search terms themselves are never sent to or stored by BOOEE — see below.
- Advertising or analytics trackers. No Google Analytics, no Meta Pixel, no ad network of any kind.
- A market for your data. It is never sold, rented, or shared for advertising purposes.
Site and search filtering
Beyond your own blocked-sites list, BOOEE ships three optional, on-by-default protections, all controllable from Settings:
- Bundled default adult-sites list. A maintained list of well-known adult domains, checked in addition to your own list. Sites on it are blocked at the network level — before the page loads at all — with no "Continue to Site" option, unlike your own custom list.
- Forced Safe Search. Google, Bing, DuckDuckGo, and YouTube are locked into their own strict filtering modes on every search, using each platform's own published mechanism for network-level enforcement (the same one schools and libraries use) — not a setting on those sites you could just switch back.
- Explicit-keyword filter. Any page whose address contains one of a small set of explicit terms is blocked before it loads, on any site — not just ones on a list. This is the one layer that can catch a site BOOEE has never seen before.
All three checks run entirely inside Chrome's own network-request engine (the declarativeNetRequest API), directly on your device. BOOEE's own code doesn't see, log, or transmit the URL, domain, or search terms that triggered a match — only that an incident happened, when, and (for the bundled list) which known site it was. A keyword-triggered block is recorded with no domain or URL at all, anywhere, including in the blocked page's own address bar.
Each of these three protections can be turned off individually in Settings, if you'd rather rely only on your own blocked-sites list.
How we use it
- The pause screen's verse comes from a public Bible reference lookup, matched to the translation you've chosen — no personal information is sent to look it up.
- Dashboard numbers (streak, urges interrupted, weekly incidents) are computed from your own incident log and shown only to you.
- Contacting a partner by email sends a message through our email provider, Resend, using the email you gave us.
- Contacting a partner by text opens your own phone's messaging app with the message pre-filled — that text is sent straight from your device. BOOEE's servers never see or transmit it.
Your controls
- Add or remove sites from your blocked list at any time, in the dashboard.
- Add or remove accountability partners at any time. Removing one doesn't notify them — tell them yourself if that matters to you.
- Turn the pause screen's verse on or off, and adjust your lockout duration, from Settings.
- Turn the bundled default adult-sites list, forced Safe Search, or the explicit-keyword filter on or off individually, from Settings.
- Delete your account entirely — see below.
Deleting your account
Deleting your account removes your profile, settings, blocked sites, partners, and incident history — immediately. There's no recovery window and no soft-delete. Once it's gone, it's gone.
Incognito windows
Chrome disables every extension in Incognito windows by default, and BOOEE is no exception — it won't run there unless you specifically turn on "Allow in Incognito" for it from chrome://extensions.
Not for children
BOOEE deals with adult-content accountability and isn't intended for anyone under 18. We don't knowingly collect information from minors, and we'll delete any account we learn belongs to one.
Security
- All traffic between the extension and our server, and between our server and its providers, is encrypted in transit (HTTPS/TLS).
- Database access is restricted by row-level security, keyed to your own account — your data isn't reachable by other users' sessions.
- No system is perfect, and we can't promise absolute security, but we treat this information as sensitive and design around that.
Changes to this policy
If this policy changes, we'll update the effective date at the top of this page. We won't apply a meaningful change retroactively without telling you first.
Contact
Questions about this policy, or about your own data, can go to support@booee.app.