Privacy Policy

Last updated: August 5, 2026

This is a draft policy for a product still in development; it will be finalised, with a real date and a proper legal read-through, when Sunda Spotless is submitted to the Chrome Web Store.

What Sunda reads

To tell one page from another, Sunda needs a peek at it: the address, the page title, and a little of the wording on the page. Not the whole page — a short sample, enough to form an opinion. If there's barely any wording there at all (a bare sign-in box, say), the model is never asked to guess from nothing: it is skipped entirely. All that can still apply to such a page is Sunda's own short, curated list of addresses that are unmistakably explicit — if the page is on that list, it is still swept.

That peek only ever happens on ordinary web pages, the http:// and https:// kind. Files on your own computer, Chrome's own settings pages, and other extensions' pages are off-limits — always, with no setting that can change it. And none of it happens until you have granted Sunda access yourself (see the permissions below). Before that, it is completely inert.

The judging happens inside your browser, by a small language model that lives on your computer. The words it looks at are used in the moment and then let go: they are never written to disk and never leave the machine. Sunda does remember its verdict for a site while the browser is open, so it needn't look twice — that memory lives only in memory, and it's gone when you close Chrome. Searches and AI chats are never remembered that way; each one is judged fresh, on its own merits.

Sunda takes no screenshots of your pages, and it doesn't watch which tab you're on. It also isn't reading your pages to build a profile of you — there is nowhere for such a thing to go.

What is stored, and where

Not a great deal, and all of it on your own computer:

• Your switch — whether Sunda is cleaning or napping.
• Your eagerness preset — Low, Medium or High.
• The “recently cleaned” records — the short list you see in the popup.
• A diagnostic log — a rolling record of what Sunda itself did: it woke up, it judged something, it ran into a snag. Addresses, site names and page wording are stripped out before a line is ever written, so what's left describes Sunda's behaviour rather than your browsing. It's there for one reason: if something goes wrong, there needs to be something to look at. It's capped at 5,000 lines — the oldest fall off the end — it stays on your computer, and it is never sent anywhere.
• The sealed vault — only if you've set a secret word: the small sealed bundle that guards the readable list (more on it just below). It lives in device-local storage and is never synced to another machine.

The first two are ordinary Chrome settings, so if you're signed into Chrome they may ride along with your other browser settings to your other computers. They're two small preferences and they say nothing whatsoever about where you have been.

The records are the interesting part. By default a record is a bare timestamp — a time and nothing else. Not the site, not the address, not what the page was judged to be. “Private” is meant literally here: there is nothing written down to reveal, to us or to anyone who picks up your laptop.

If you'd rather have a readable list, you can set a secret word. From then on the site name and the verdict are sealed before they're saved: each entry is encrypted with an RSA-OAEP-2048 key, and the private half of that key is itself wrapped with AES-GCM under a key stretched from your secret word (PBKDF2-SHA256, 310,000 rounds). Only the wrapped blob is stored, in device-local storage that is never synced to your other machines. Your secret word itself is never stored anywhere, in any form — a wrong word simply fails to open the list, because there's no password on file to check it against.

Unlocking happens inside the popup. The key that unlocks it exists only while that popup is open and vanishes the moment you close it; it is never saved and never sent anywhere, not even to Sunda's own background worker. A locked row shows you a time and a hatched bar of fixed width — a stack of them doesn't even leak how long the names behind them are. And because each entry is sealed with fresh randomness, the same site looks different every time: the list gives away no “that one again” pattern.

What is deleted

When Sunda decides a page is adult or sexually explicit, it deletes that page's entry from your browser history — that one entry, the moment it turns up. Nothing else is touched: not your bookmarks, not your downloads, not your passwords, not the page itself.

Be aware that this is a real deletion, the same one Chrome performs when you clear an item by hand. There is no undo and no bin to fish it back out of. Sunda is a careful judge and it errs towards leaving pages alone, but it is not perfect: it will occasionally miss something, and on the “High” setting it may now and then sweep a page you'd have kept.

What leaves your device

Nothing about your browsing. Not the addresses, not the titles, not the wording, not the verdicts, not even a count of how many pages were cleaned. There is no server on our side that could receive it.

• The model, once. The first time Sunda needs to judge something, it downloads the model it judges with from Hugging Face and keeps it on your computer. That request carries nothing of yours in either direction — it only fetches the model file. After it lands, judging is entirely offline.
• That's the whole list. No analytics, no telemetry, no crash reports, no usage statistics, no advertising, no tracking code of anybody's. The one piece of outside code Sunda does carry is the open-source runtime that lets the model think in your browser at all; it ships inside the extension, and once the model is cached it makes no network requests of its own. Nothing about you is sold, shared, rented or handed to anyone, because nothing about you is ever collected in the first place.

The permissions Chrome asks about

Each one is there for a specific job, and there are no spare ones:

• History — to remove the entry for a page it has swept. This is the whole point of the extension.
• Storage — to keep your switch, your eagerness preset and the “recently cleaned” records on your computer.
• Alarms — Chrome's little kitchen timer. Sunda uses it to shut its own judging workspace down again when it has been idle, rather than leaving it running.
• Offscreen — to open that hidden workspace, a private page inside the extension where the model does its thinking. It has no view of your tabs.
• Scripting — to collect the title and a little of the wording from a page you've just opened, so there is something to judge.
• Access to Hugging Face's download hosts — the three addresses Sunda's own model is served from, which Chrome does show you at install time. They are used for exactly one thing: fetching that model the first time, and never for anything else. In a fully bundled build, where the model ships inside the extension, they're dropped from the manifest altogether.
• Access to the sites you visit — optional, and yours to give. This is the big one, so Sunda doesn't take it at install time: the Web Store listing carries no scary “read all your data on all websites” warning, because that access is optional. The popup asks for it with a button that says “Let Sunda take a look”, Chrome puts up its own prompt, and until you say yes the extension does nothing at all. You can take it back whenever you like, from Chrome's own extension settings, and Sunda unhooks itself completely when you do.

What you're in control of

• Turn it off. Flip the switch in the popup and Sunda goes for a nap. Nothing is read, nothing is judged, nothing is deleted. Records already in the list stay there until you clear them.
• Change how eager it is. Low, Medium or High, any time. It only affects what happens from that moment on — nothing already swept comes back.
• Take the access back. Revoke the site access in Chrome and Sunda goes inert again: no reading, no judging, no deleting, until you grant it afresh. Your switch, your preset and your list stay as they were.
• “Forget & clear.” This wipes the sealed vault and the list of records together, in one go. Nothing readable survives — without the private key the sealed entries could never have been opened again anyway.
• Uninstall. Chrome removes the extension and everything it kept: the switch, the preset, the vault, the list, the downloaded model. History entries that were already deleted stay deleted — those are gone from Chrome, not from Sunda.

Children

Sunda Spotless is a tool for adults tidying up their own browser. It isn't a parental control, a filter or a monitoring tool: it blocks nothing, warns nobody, and reports to no one — it simply removes a history entry after the fact. It is not directed at children, and it collects no personal information from anybody, of any age.

Chrome Web Store limited use

Sunda Spotless's use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. In practice that promise is an easy one to keep: the information is used on your computer, for the one purpose of judging a page and removing its history entry, and it is never transferred, sold, or used for advertising, profiling, credit assessment or anything else. No human — us included — ever reads it, because there is nowhere for it to go.

Changes to this policy

If anything here changes in a way that matters, it will be updated on this page, with the date at the top, before the change takes effect. Sunda is not going to start collecting things quietly.

Contact

Sunda Spotless hasn't reached the Chrome Web Store yet, so there's no support inbox to point you at just now. When it is published, the contact address will be on the store listing and it will be added here too. If a question about your privacy can't wait until then, the honest answer is that we hold nothing of yours to look up: there is no account to close and no data to request or delete, only what is on your own computer, which is yours to clear at any time.

← Back to home