Shoot@Site — Privacy Policy

Shoot@Site (the "Extension") is a browser extension that overlays a 3D shooting game on top of the page you are viewing. This page describes what information the Extension collects, how it is used, and what it is not used for.

Summary

• No accounts, no logins, no personally identifiable information.
• No advertising trackers, no third-party analytics SDKs.
• No selling of user data — ever.
• The Extension transmits two small pieces of data when you fire a weapon: the weapon name (e.g. pistol, ak47, shotgun) and the bare hostname of the page you are on (e.g. news.ycombinator.com). That is the entirety of what we collect.

Data we collect

When you actively use the Extension by firing a weapon at a page, the background worker batches and POSTs the following to our own API at https://api.shoot.shafu.xyz/events:

We do not transmit:

• Full URLs (only the bare hostname)
• Page titles, page content, text, or screenshots
• Cookies, form data, or anything you type
• Personally identifiable information (name, email, account ID)
• Browsing history outside of the moment you fire the Extension
• IP-address-derived geolocation, device fingerprints, or advertising IDs

Data we store on your device

The Extension uses your browser's localStorage to cache:

• The sponsor-panel JSON config (so the "Brought to you by" panel renders instantly on next load)
• A short-lived snapshot of public usage counters shown in the HUD's stats panel

This data never leaves your device. It is automatically removed when you uninstall the Extension or clear your browser storage.

Sponsor links

The HUD shows a small rotating "Brought to you by" panel. Clicking a sponsor opens https://api.shoot.shafu.xyz/go/<id>, which records the click (sponsor id only — no other data) and redirects you to the sponsor's site. The destination site's own privacy policy applies once you arrive there.

Permissions explained

• activeTab — granted only when you explicitly invoke the Extension on the current tab (toolbar icon, Alt+Shift+S shortcut, or right-click → "Shoot@Site"). No background or cross-tab access.
• scripting — used together with activeTab to inject the overlay code on demand into the tab you just invoked it on. The Extension does not register a static content script on every page; nothing runs on a page until you explicitly ask for it.
• contextMenus — used to add the single "Shoot@Site" entry to the page right-click menu. We only read the tab.id of the right-clicked tab, never the page content, URL, or selection.
• Host permission https://*.shafu.xyz/* — used to fetch the sponsor JSON and sponsor logo images from our own servers. Restricted strictly to our own subdomains.

Network logs

Our API is hosted on Cloudflare. Like all HTTP services, Cloudflare's edge may transiently observe your IP address while routing the request. We do not record, store, or correlate IP addresses with the {gun, domain} events on our side. We have no way to identify an individual user.

Third parties

The Extension does not communicate with any third party other than our own infrastructure on *.shafu.xyz. No Google Analytics, no Sentry, no advertising networks, no data brokers.

Data retention and deletion

The aggregate {gun, domain} events are retained indefinitely for product-usage analytics. Because no event is associated with a user identifier, there is nothing to "delete" on a per-user basis — uninstalling the Extension immediately and permanently stops any further data being sent.

Children

The Extension is a casual, non-violent novelty (it shatters DOM elements, not people) and is not directed at children under 13. We do not knowingly collect data from children.

Changes

If this policy changes materially, the "Last updated" date above will change and the new version will be published at the same URL.

Contact

Questions or concerns: hey@shafu.xyz