Security

What the extension is allowed to do

Turan ships with exactly two declared permissions:

• storage — remember your preset, intensity, and per-site rules.
• host_permissions (optional) — required only if you enable per-site overrides, because the extension must then read the current tab's address to match your rules.

It requests nothing else. There is no tabs, no webRequest, no cookies, no clipboardRead. If a future version needs a new permission, we will say so in the changelog and in the Chrome Web Store listing before you are asked to approve it.

What we never do

• We do not read page text, form fields, or keystrokes.
• We do not collect browsing history, and we do not build a profile of the sites you visit.
• We do not inject analytics, telemetry, or advertising scripts of any kind.
• We do not upload the contents of your screen.

The colour maths runs locally. The extension works with your network connection disabled.

Accounts, payments, and what the server sees

Buying a licence requires a server, and the server sees only what it must:

• the email address you sign in with;
• the payment record your provider sends us through a signed webhook (order id, amount, currency, status — never your card number);
• a hashed device identifier. The extension generates a random value and sends it when a licence is activated; the server immediately computes an HMAC-SHA256 digest with a key held server-side and stores only that digest. The value you sent is never written to the database or to our logs. It cannot be reversed into a machine, and it means nothing outside our own database.

If you never create an account, no server ever sees you at all.

Payments

Card details are handled entirely by the payment provider. They never reach our infrastructure, and we could not store them even if we wanted to — the webhook payload does not contain them.

Webhooks are verified with an HMAC-SHA256 signature over the raw request body before any state changes. Requests that fail verification are rejected and logged, never applied.

Supply chain

• The dependency tree is small on purpose. Fewer packages means fewer maintainers who can be compromised and fewer things to audit.
• The extension is built from a tagged commit in CI; the published package is reproducible from that tag.
• Releases are signed, and the extension's release publishes the checksum of the .zip.
• We do not load remote code at runtime. No CDN script tags, no eval, no remote config that can silently change behaviour.

Reporting a vulnerability

Email us before opening a public issue. Please include the version number (found in chrome://extensions), the browser version, and a minimal reproduction.

We aim to:

• acknowledge within 2 business days;
• give a remediation timeline within 7 days;
• credit you in the changelog unless you prefer otherwise.

We will not threaten legal action against researchers who act in good faith, follow this process, and avoid privacy violations, data destruction, and service disruption.

Licence enforcement and privacy

Licence checks are deliberately boring:

• Activation is a single signed token, verified locally with a public key.
• After activation, the extension keeps working offline for a 7-day grace window, so a flaky network, a firewall, or a laptop on a plane never locks you out.
• We do not phone home while you browse, and we do not send any list of the sites you visit as part of a licence check.

If you believe a licence check is behaving in a way that contradicts this page, tell us. A privacy claim that does not match the code is worse than no claim at all.