Privacy Policy - Cart Freeze

1. Who we are

Cart Freeze is a Chrome browser extension developed and operated by:

Camilo Castillo Suescun
Cl. 89 #29 86, Pereira, Risaralda 660008, Colombia
Email: proyectoscolsas@gmail.com

The developer is committed to complying with applicable data protection regulations, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Colombia's data protection law (Ley Estatutaria 1581 de 2012 and Decree 1377 de 2013).

2. What this policy covers

This policy describes how Cart Freeze handles information when you install and use the extension. It covers:

Data that stays on your device and is never transmitted
Anonymous data you may optionally share to help improve the extension
Your rights regarding that data

3. Data that stays on your device (never transmitted)

Cart Freeze must access certain information to function. This data never leaves your browser and is stored only in your local browser storage:

Data	Why it is accessed	Where it is stored
Current page URL	Detect checkout and cart pages	Not stored; read in memory only
Website domain of visited shopping sites	Track which sites you have paused on in a session	`chrome.storage.local` (your device only)
Button and form interactions	Intercept purchase actions to show the pause modal	Not stored; handled in memory only
Your extension settings	Apply your preferences (frequency, wait time, steps, etc.)	`chrome.storage.sync` (your Google account, encrypted)
Pause counts and outcomes per site	Show your personal stats in the popup	`chrome.storage.local` (your device only)
First install date	Calculate days since install for the stats display	`chrome.storage.local` (your device only)

You can delete all local data at any time using the "Reset Stats" button in the extension settings, or by uninstalling the extension.

4. Optional anonymous analytics (opt-in only)

Analytics are disabled by default. You must explicitly enable them by toggling "Help improve Cart Freeze" in the extension settings. You can turn them off at any time.

When enabled, Cart Freeze sends the following anonymous data after each purchase interception:

Field	What it contains	What it does NOT contain
Event type	`interception`, `purchase_allowed`, `purchase_stopped`	What you were buying
Domain	`amazon.com` (normalized, no subdomains)	Full URL, page title, or page content
Button category	`buy_now`, `checkout`, `express`, or `add_to_cart`	The element label or page context
Detection method	Whether the pause was triggered by a button click or checkout page URL	Your navigation path
Reflection choice	Option selected in the reflection step (`need`, `wait`, `think`), if shown	Any free-text input
Settings snapshot	Number of steps, wait duration, frequency mode, whether you use a custom message (yes/no)	The content of your custom message
Extension version	e.g., `1.1.12`	Nothing else about your software
Browser language	e.g., `en`, `es`	Your country, region, or IP address
Tracking protection state	Whether Tracking Protection was on or off	Which sites you visited
Rotating install ID	A random 32-character hex string that rotates every 30 days	Your identity, device ID, or any persistent identifier
Rounded timestamp	The event hour only (e.g., `2026-06-19T14:00:00Z`)	The minute or second of the event

What we never collect or store

Your name, email address, or any personally identifiable information
Your IP address (explicitly excluded from our database)
Product names, prices, cart contents, or purchase amounts
Full URLs or page titles
Cookies or authentication tokens
Device identifiers, hardware fingerprints, or persistent user IDs
Browsing history outside of checkout and cart detection

5. How we use analytics data

Analytics data is used exclusively to improve the Cart Freeze extension:

Understand which features users find most useful
Identify which shopping sites benefit most from a mindful pause
Detect regressions or unexpected behavior after a new release
Decide which sites to add to the default interception list

We do not:

Sell your data to any third party
Share your data with advertisers, retailers, or data brokers
Use your data to target advertising
Use your data for any purpose unrelated to developing and improving Cart Freeze
Use your data to determine creditworthiness or for lending purposes

6. Legal basis for processing (GDPR)

If you are in the European Economic Area (EEA), we process data under the following legal bases:

Processing activity	Legal basis
Accessing page URLs in memory to detect checkout pages	Art. 6(1)(b) GDPR - necessary to perform the service you requested
Storing stats and settings locally on your device	Art. 6(1)(b) GDPR - necessary to perform the service you requested
Sending anonymous analytics events	Art. 6(1)(a) GDPR - your explicit consent via the opt-in toggle

You may withdraw consent for analytics at any time by toggling off the analytics setting. Withdrawal does not affect the lawfulness of processing before the withdrawal.

7. Third-party service providers

When analytics is enabled, event data is stored in a database hosted by:

Supabase, Inc.
970 Toa Payoh North, #07-04, Singapore 318992
Privacy: supabase.com/privacy

Supabase acts as a data processor on our behalf. They process data only according to our instructions and under a Data Processing Agreement compliant with GDPR. No other third-party services receive your data. The extension does not use advertising SDKs, social login, or third-party analytics platforms.

8. International data transfers

Our analytics server and database are operated outside your country of residence. If you are in the EEA, transfers to non-EEA countries are made using appropriate safeguards:

For transfers to Supabase: we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

If you would like a copy of the applicable safeguards, contact us at proyectoscolsas@gmail.com.

9. Data retention

Data	Retention period
Local stats and settings	Until you reset them in the extension or uninstall
Analytics events	Retained indefinitely in aggregate. The rotating install ID means events older than 30 days cannot be linked to more recent events, even by us.

We do not retain any data that would allow us to identify an individual user across sessions.

10. Your rights

GDPR rights (EEA residents)

Right of access (Art. 15): You may request confirmation of whether we process data about you. Because we store no personal data, there is generally no individual record to return.
Right to rectification (Art. 16): You may request correction of inaccurate data. Not applicable given the anonymous nature of collected data.
Right to erasure (Art. 17): You may request deletion of your data. Because we cannot link the rotating install ID to you after it rotates, we are generally unable to identify specific events. Opting out of analytics prevents all future collection.
Right to restrict processing (Art. 18): Turning off analytics in settings achieves this immediately.
Right to data portability (Art. 20): Applicable only to data processed on the basis of consent.
Right to object (Art. 21): Turning off analytics immediately stops all data collection.
Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority. A list of EU DPAs is available at edpb.europa.eu.

CCPA rights (California residents)

Know what personal information is collected, used, shared, or sold
Opt out of the sale of personal information (we do not sell personal information)
Request deletion of personal information
Not be discriminated against for exercising these rights

Colombian rights (Ley 1581 de 2012)

Colombian residents have the right to know, update, rectify, and request deletion of their personal data. Contact us at proyectoscolsas@gmail.com to exercise these rights.

11. How to exercise your rights

Email: proyectoscolsas@gmail.com

We will respond within 30 days. For verified GDPR erasure requests, we will delete all data we can identify and confirm in writing.

12. Tracking Protection feature

Cart Freeze includes an optional Tracking Protection feature that blocks third-party tracking scripts (Facebook Pixel, Google Ads, TikTok Pixel, etc.) from loading on shopping sites. This feature:

Works entirely via the browser's built-in declarativeNetRequest API (no data is sent to our servers to perform blocking)
Does not log which scripts were blocked or which sites you visited
Is disabled by default and must be explicitly enabled

13. Chrome Web Store data disclosure

Cart Freeze has disclosed the following to the Chrome Web Store:

Web history - Cart Freeze reads the current page URL in memory to detect checkout or cart pages. URLs are not stored, transmitted, or logged.

User activity - Cart Freeze intercepts button clicks and form submissions to show the pause modal. These interactions are not stored or transmitted; only anonymized aggregate outcomes are included in optional analytics.

We certify that your data is not sold to third parties, not used for purposes unrelated to Cart Freeze's core functionality, and not used to determine creditworthiness or for lending purposes.

14. Children's privacy

Cart Freeze is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect data from children. If you believe a child has enabled analytics and you are their guardian, contact proyectoscolsas@gmail.com and we will delete any identifiable data.

15. Security

We implement reasonable technical and organizational measures to protect analytics data, including:

HTTPS for all data transmission
Row-level access controls on the analytics database
No storage of IP addresses or device identifiers
Service-role database keys stored only in server environment variables, never in the extension

16. Changes to this policy

We will post updates to this document if we change what data is collected or how it is used. For material changes (new data types, new purposes, or new third-party sharing), we will:

Update the "Effective date" at the top of this document
Increment the version number
Require the analytics opt-in toggle to be re-enabled by the user

Non-material changes (corrections, clarifications, new contact details) may be made without re-consent.

17. Contact

Data controller:
Camilo Castillo Suescun
Cl. 89 #29 86, Pereira, Risaralda 660008, Colombia
Email: proyectoscolsas@gmail.com

For GDPR inquiries from EEA residents, we aim to respond within 30 days and, where required, within the 1-month deadline imposed by Art. 12 GDPR.