Privacy Policy — Refresh Monitor

Effective date: 23 August 2026

This extension is deployed by IT/Admin on company-managed devices for support agents, to make page refreshes on support-tool URLs observable and attributable. Agents should be notified of this monitoring through the usual employee handbook / acceptable-use-policy channel before deployment; this document exists to make that disclosure accurate.

What is collected

For each detected refresh on a URL matching the admin-configured targetUrlPatterns:

Field	Description
`userId`	Agent identity — email (Chrome managed profile) or manually entered ID, per `userIdSource` config.
`timestamp`	ISO-8601 time of the refresh.
`url`	Full URL of the page that was refreshed.
`cause`	How the refresh was detected: `keyboard` (F5/Ctrl+R/Cmd+R), `beforeunload` (page unload not attributed to a keypress), or `navigation-reload` (same-URL reload detected by the background service worker).
`tabId`	Chrome's internal tab identifier (not persisted across browser restarts).
`windowFocused`	Whether the tab's window had focus at the time.
`screenshot` (optional)	A JPEG (quality 50, capped at 1280px) of the visible tab at the moment of refresh, base64-encoded. Only captured if `screenshotEnabled` is set by an admin. Disabled by default.

The extension does not capture keystrokes, form contents, page text, or browsing history outside of the configured target patterns. Content scripts run on all pages only to detect the reload keypress/unload signal on whichever tab is active; they do not read or transmit page content.

Where it is stored

Locally, in the browser's chrome.storage.local, capped at retentionMaxEvents (default 1000) entries — oldest events are dropped first.
Remotely, only if an admin sets backendEndpoint in policy or options. When set, each event is POSTed to that endpoint over HTTPS as it occurs. If unset, no data leaves the device.

Who can access it

The agent using the browser can view and export their own device's local event log via the extension popup (JSON/CSV export).
IT/Admin can access aggregated data only if a backendEndpoint is configured and they control that backend.

Retention and deletion

Local events beyond retentionMaxEvents are automatically discarded.
To clear all local data, remove the extension or clear the browser profile's extension storage.

Recommended admin practice

Disclose this monitoring to support staff before deployment.
Keep screenshotEnabled: false unless a specific incident/compliance review justifies enabling it.
Narrow targetUrlPatterns to the actual support-tool domain(s) rather than leaving the default wildcard, to minimize scope.

For questions, contact your IT/Admin team.