LaunchPal is a Chrome extension that audits websites. This page says exactly what it touches and
what leaves your browser. It applies to the extension and to this website.
The short version
Scans happen inside your browser. Page content, page source, found secrets, URLs and findings never
leave your machine. The only network call the extension makes is a licence check, which sends a
licence key and a random install id.
What is stored on your device
Kept in chrome.storage and never transmitted:
the name you give your blob, synced with your Chrome profile
your licence key, plan, expiry and a random install id
the origins you have verified, and the verification token for each
for Pro users only: saved scan history and findings
Uninstalling the extension removes all of it.
What leaves your browser
Licence checks. On startup and when you activate a key, the extension sends your
licence key and install id to our licence service. Nothing else. No page data, no URLs, no findings.
Payments. Card, M-Pesa, Airtel Money and bank transfers are handled by
Paystack on its own hosted checkout page. Paystack is the payment processor and
holds your payment details. We receive the payment event and the email address used at checkout.
That address is what a licence is tied to.
Key delivery. After payment, Paystack returns you to our claim page, which checks
the transaction with Paystack and shows your licence key once. Only a hash of the key is stored,
so it cannot be shown again. We do not store the key itself.
Nothing else is collected. No analytics, no advertising, no telemetry, no crash reporting.
What a scan reads
With the page you have open, after you click the extension icon: the rendered page, its scripts,
forms, links, images, styles and response headers.
For deeper scans only, on origins you verify by publishing a token: read-only GET and HEAD requests
to that same origin, rate limited, at most 40 per scan, stoppable at any time.
Deeper scans never run on a site you have not verified.
Secrets
If the scan finds something that looks like a credential in page source, the value is masked in the
report, for example sk-...a3f9. Full secrets are never displayed, never stored, and
never sent anywhere.
This website
The site is static. It sets no cookies, loads no third-party scripts, and uses no analytics. Server
logs at our host record the usual request metadata (IP address, user agent, requested path) for
security and abuse prevention.
Your choices
Deactivate a browser in Settings to release an activation slot.
Delete saved scans in the extension, or uninstall to remove everything local.