MERLEWATCH

DRAFT, review before launch. This document has not been reviewed by a lawyer.

Privacy Policy

Last updated: 2 November 2026

This policy explains how Merlewatch (the Chrome extension and this website) handles personal information. This policy is from Merlewatch (an independent developer based in Victoria, Australia) (“I”, “me”, “we”). Contact: merlewatch.support@gmail.com. I aim to follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

The short version

1. What the extension sends, and to whom

Password checks: Have I Been Pwned (Pwned Passwords)

When you check a password (in the popup), the extension turns it into a SHA-1 hash on your computer and sends only the first 5 characters of that hash to the Pwned Passwords API (api.pwnedpasswords.com), run by Have I Been Pwned (Troy Hunt, Australia) and served through Cloudflare. That 5-character prefix matches hundreds of different passwords, so it cannot identify your password. No cookies are sent with these requests. Like any website, the API receives your IP address and browser details as part of the connection; I don’t receive or keep these. See the Have I Been Pwned privacy policy.

Nothing else

The extension contacts no other servers. It has no analytics, crash reporting or advertising code.

2. What the extension stores on your computer

In Chrome’s local extension storage, on your computer only:

I can’t see any of this. Uninstalling removes everything.

3. Paying

Merlewatch is currently free. Nothing is sold, so no payment details are collected.

4. This website

This website sets no cookies and has no forms. It is hosted on Cloudflare Pages. Cloudflare processes your IP address and request details to deliver the site and protect it from attacks. The site may use Cloudflare Web Analytics, which counts page views and page performance without cookies, without fingerprinting and without tracking you across sites. See the Cloudflare privacy policy.

5. Email

If you email me, I receive your email address and whatever you write. I use it only to reply and keep it only as long as needed for support, refunds or legal records.

6. Third parties, named

Some of these companies are overseas (mainly the USA), so information they handle may be stored or processed outside Australia.

7. No selling, no ads, no tracking

I don’t sell, rent or trade personal information. I don’t use it for advertising, profiling or credit-worthiness, and I don’t allow anyone else to.

8. Chrome Web Store User Data Policy

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

9. Security

The extension follows Chrome’s strict security rules (no remote code), sends only what is described above over HTTPS, and is reviewed for security before release. No system is perfectly secure, but the design means there is very little to protect: your passwords are never collected.

10. Access, correction and deletion

You can ask what personal information I hold about you (usually only email records), ask me to correct it, or ask me to delete it where I’m not required to keep it (for example, tax records must be kept for 5 years). Email merlewatch.support@gmail.com. I’ll respond within 30 days. You can use a pseudonym when emailing me.

11. Complaints

If you think I’ve mishandled your personal information, email me first at merlewatch.support@gmail.com with the details. I will acknowledge it within 7 days and aim to resolve it within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992.

12. Children

Merlewatch doesn’t knowingly collect information from anyone, including children.

13. Changes

If this policy changes, I’ll update the date above and, for important changes, mention it in the extension’s release notes.

14. Contact

Merlewatch (an independent developer based in Victoria, Australia). Email: merlewatch.support@gmail.com.