Privacy Policy

Last updated: May 12, 2026

DomKeeper ("the Service") is a Chrome browser extension plus a companion cloud storage backend. This policy describes what we collect, how we use it, and how we protect it.

1. Who runs this service

The Service is operated by the individual owner of the domain gg.9iqz.cn. It is not a corporate entity. Contact information is at the bottom of this page.

2. What we collect

2.1 Account information

When you sign in via Google OAuth 2.0, we obtain from your Google account:

• Your Google user ID (an opaque identifier; we cannot reverse it to your real-world identity)
• Your email address
• Your display name (from your Google profile)
• Your avatar URL (from your Google profile)

We use this only to identify your account and to show your current sign-in status inside the extension.

2.2 Uploaded content

Screenshots you actively upload via the extension. For each one we also store:

• The PNG file itself
• The URL of the page where the screenshot was taken
• The page title
• A CSS selector identifying the element you picked
• Width, height, and file size
• Upload timestamp

2.3 Technical data

• Your session token (kept while you stay signed in; expires after 30 days)
• IP address and User-Agent at sign-in time, for session audit purposes (retained until the session expires)
• Standard web server access logs (IP, timestamp; typically rotated out after 30 days)

3. What we don't collect

• We don't take screenshots automatically — every upload is triggered by you clicking the screenshot button.
• We don't read any of your pages' content unless you explicitly capture them.
• We don't track your browsing history.
• We don't use analytics or advertising cookies.
• We don't access your Gmail, Drive, Calendar, or any other Google service. The OAuth scopes we request are limited to userinfo.email and userinfo.profile.

4. How we use the data

Data is used solely to:

• Provide the core feature of the Service (upload, view, delete your own screenshots)
• Identify your account
• Enforce anti-abuse limits (storage quota, rate limiting)

We will not:

• Sell or share your data with any third party
• Insert ads or trackers into your screenshots
• Look at your screenshots without your permission
• Use your data to train AI models

5. Visibility of your content

Every screenshot you upload is visible only to you. Image access goes through the view.php endpoint, which checks your session token and verifies the owner before serving the file.

Image files are stored outside the web root (at /var/www/domkeeper_image/), so there is no direct URL that bypasses the auth check.

The Service offers no public-link sharing, no share-by-QR, and no public gallery.

6. Where data is stored

All data (account info, screenshot files, metadata) is stored on the gg.9iqz.cn server, physically located outside mainland China (specific region available upon request).

7. Your rights

7.1 Right of access

You can view all of your screenshots at any time on the gallery page.

7.2 Right to deletion

• Per-item: click the "Delete" button under each screenshot card in the gallery.
• Whole account: click "🗑 Delete account" at the top right of the gallery. Your screenshot files, database records, and session data are removed from the server immediately; this is irreversible.

7.3 Right to data portability

Click "📦 Export my data" at the top of the gallery to download a JSON file containing all your screenshot metadata (IDs, URLs, titles, sizes, timestamps, download URLs).

7.4 Right to withdraw consent

You can revoke OAuth authorization any time at myaccount.google.com/permissions. The extension will then automatically sign you out. Note: revoking the OAuth grant does not automatically delete data already on the server — to delete data, use the "Delete account" function in 7.2.

8. Retention periods

• Uploaded screenshots: kept until you delete them or delete your account.
• Session tokens: automatically expire after 30 days.
• Web server access logs: rotated out after roughly 30 days.
• After an account deletion: all primary data is wiped immediately. Database backups (if any) will be overwritten within the 30-day backup rotation.

9. Security

• All client-to-server traffic is encrypted via HTTPS.
• Session tokens are 32 bytes of cryptographic randomness.
• Database credentials and config files are restricted to mode 0600 (server-user only).
• Image files live outside the web root; no direct URL access.

That said, the Service is run by an individual, not a company with enterprise-grade security operations. Please do not upload material that is more sensitive than what you would be willing to store on a standard cloud drive like Google Drive or Dropbox.

10. Children's privacy

The Service is not directed to children under 13. We do not knowingly collect information from anyone under 13. If we learn that a user is under 13, we will delete the account and all associated data.

11. Changes to this policy

Material changes will be re-surfaced through the in-extension consent dialog, requiring you to re-accept. Minor edits will be reflected by updating the "Last updated" date at the top of this page.

12. Contact

For questions about this policy, data subject requests, or complaints:

• Email: privacy@duiyizhe.com
• Please include your Google account email so we can verify your identity.

Back to gallery · Terms of Service