What The Shitlist Does

The Shitlist is a personal blocklist manager. You maintain a list of entries (names, aliases, categories, and comments) through this web application. The companion browser extension scans web pages you visit and highlights matching names locally in your browser.

Data You Provide

When you create an account, we store:

• Your email address and a hashed password (for authentication)
• Entries you create: names, aliases, categories, and comments
• API keys you generate (for the browser extension)

All of this data is stored on our server and is accessible only to you through your authenticated account or API key.

How the Browser Extension Works

The browser extension:

• Fetches your entries from the-shitlist.com using your API key, and caches them locally in your browser's storage.
• Scans page content locally in your browser to find matching names. Page content is never sent to our server.
• Highlights matches directly in the page you are viewing.

The extension communicates only with the-shitlist.com to sync your entries. It does not send any data about the pages you visit, your browsing history, or any page content to our server or any third party.

Local Storage

The browser extension stores the following data locally on your device:

• Settings (synced across browser profiles): your API key, highlight style and color preferences, sync interval, and disabled sites list.
• Cached entries (device-local): a local copy of your entries and categories for fast page scanning without repeated server requests.

You can clear this data at any time by removing the extension or clearing extension storage through your browser's settings.

Third Parties

We do not share, sell, or transfer your data to any third party. There are no analytics, advertising, or tracking services embedded in the web application or the browser extension.

Data Retention and Deletion

Your data is stored for as long as you maintain your account. You can delete individual entries, categories, and API keys at any time through the web application. Deleting your account removes all associated data from our server.

Cached data in the browser extension is automatically refreshed on a periodic schedule and can be cleared by removing the extension.

Security

All communication between the browser extension and our server occurs over HTTPS. API keys are used for extension authentication. Passwords are hashed and never stored in plain text.

Changes to This Policy

If we make material changes to this privacy policy, we will update the "Last updated" date at the top of this page.

Contact

If you have questions about this privacy policy, contact us at john@opifex.org.