1. Overview
This policy applies to MASK at mask-zeta-murex.vercel.app and the MASK Chrome collector. MASK provides account-based browsing activity reports and optional camera-based session tracking.
The Chrome collector requires sign-in and your selection of Start collection. Camera features require camera permission and your choice to enroll or track. Visiting this public policy or the homepage does not start collection.
2. Information we collect
Account information
We use your email address and account identifier to authenticate you and associate records with your account. Email and password sign-in is handled by Supabase Auth. MASK does not save your password in browser storage; temporary access and refresh tokens keep you signed in.
Chrome activity, while collection is enabled
The collector reads the active tab URL to extract its domain name. Records sent to Supabase contain the domain, start and end times, active and idle duration, account and device identifiers, record identifiers, and collector status or last-sync information. If you enable face verification, a matched enrolled-person identifier may also be attached.
Collection is limited to ordinary HTTP/HTTPS tabs while Chrome has focus. Incognito tabs, browser-internal pages, a locked computer, and activity in other applications are excluded. Chrome's idle status distinguishes active time from idle time.
The collector does not store or upload full URLs, URL paths or query strings, page contents, tab titles, screenshots, typed text, passwords, or historical browsing history.
Website tracking sessions
If you start a camera tracking session in the website, MASK records the enrolled-person identifier, session timestamps, and active or idle time within the MASK tab. Input events such as keyboard, pointer, touch, and scrolling indicate activity; the contents of those inputs are not recorded. These sessions do not monitor other desktop applications.
Service requests and support
Serving the website and authenticating or syncing data exposes network information, such as your IP address and request metadata, to our hosting and cloud providers. They may process service and security logs. If you use our support form, we receive your name, email address, selected topic, subject, and message. The form is processed by a Vercel function and delivered through Resend to our support mailbox. Temporary request counts help limit repeated submissions.
3. Optional camera features
Camera access is optional for the Chrome collector. The website also offers face enrollment and camera session tracking. Both use locally bundled models to process camera frames in your browser. MASK does not upload camera photographs, video, or audio.
Face enrollment stores a biometric template.
When you capture and save an enrollment on the website, the name you enter and a numeric face descriptor are uploaded to your account in Supabase. This descriptor is a biometric template used for recognition; it is sensitive personal information even though it is not a photograph.
For matching, the website or extension retrieves your account's enrolled templates and compares them with camera frames locally. The extension does not upload new face templates. Only enroll people who understand and agree to this use. You can use Chrome activity collection without enabling camera verification.
4. How we use information
- Sign you in, maintain your account, and recover account access.
- Save and display domain totals, active and idle time, session reports, and collector status for your account.
- Deliver live dashboard updates as your collector syncs.
- Match an enrolled face when you choose camera features.
- Handle support requests and maintain the security and operation of these features.
We do not sell your personal data or use browsing activity or face templates for advertising, creditworthiness, or lending decisions. MASK does not include advertising trackers or third-party analytics scripts.
5. Storage and security
The website is hosted on Vercel. Supabase provides authentication, database storage, and live updates. Production traffic uses HTTPS; live updates use secure WebSocket connections. Database access rules scope the app's records to the signed-in account.
The website uses browser session storage, with an in-memory fallback, for authentication and temporary settings or pending session records. The extension uses Chrome session storage for authentication, collection state, and pending uploads. These are temporary browser session stores, rather than a local application database.
The extension's session data is cleared when Chrome restarts or the extension reloads or is disabled. Sync before closing Chrome: unsynced records may be lost. Clearing browser data, signing out, or uninstalling the extension does not delete records already uploaded to Supabase.
Account restrictions do not prevent authorized service operators or infrastructure providers from accessing data where necessary to operate, secure, or support the service. No storage or transmission system can guarantee absolute security.
7. Retention and deletion
Uploaded activity, sessions, device records, and face enrollments are retained in your account until removed. MASK currently has no automatic expiry schedule for these records. The dashboard's seven-day report window is a display filter, not a deletion deadline.
To request a copy, correction, or deletion of your activity, face templates, or entire account, email mask@zendatabase.net from your account email address and describe your request. We may ask for information needed to verify account ownership. Account deletion also removes its associated MASK database records. Infrastructure logs and backup copies may remain subject to the providers' retention processes and applicable legal obligations.
There is currently no self-service account deletion button. Uninstalling the extension stops future collection but does not remove your cloud account or previously uploaded data.
Support correspondence is retained in our support mailbox for handling and following up on your request, and may also be held in the email provider's delivery records. You can contact us to request removal of that correspondence. The form does not save support messages in your MASK activity database.
8. Your choices
- Start or pause: control Chrome collection from the extension popup. Signing out stops collection after pending records have synced.
- Camera access: leave face verification disabled, stop a camera session, or revoke camera permission in your browser.
- Review your records: sign in to the website with the same account to view your reports.
- Remove the collector: disable or uninstall it from Chrome to stop further extension collection.
- Account and data requests: contact us for access, correction, deletion, or privacy questions.
The extension asks for tabs access to identify the current domain, idle access to measure active and idle time, storage to hold session state and pending records, and alarms to schedule collection and syncing. Its host permission connects it to MASK's Supabase project. No permission is used to collect page contents.
9. Contact and policy updates
For MASK privacy questions or data requests, contact mask@zendatabase.net.
We will post updates on this page and revise the date above. Material changes to what the extension collects or how it uses data will be disclosed before the changed collection takes place, with consent where required.