CometLens privacy policy

Data controller: Maciej Zmitrukiewicz (CometWeb). Privacy contact: hello@cometweb.io
Supervisory authority (Poland): UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl

The extension declares a small content script for all web pages so the right-click Inspect element feature can work. Your browser may show a broad site-access permission. On a context-menu event, the script computes a CSS selector for the selected element and passes the current URL to the extension. Temporary extension storage keeps the selector, a SHA-256 fingerprint of the URL, the capture time and a document identifier when the browser supplies one. The URL is not stored as plaintext in this capture. The helper does not send page text, form values or network requests. Insight requests start only after you choose an Insight feature.

When you connect your Insight account, the extension sends your API key to app.cometweb.io to authenticate requests. Opening a report sends the inspected page URL to look up existing results. Starting a cloud scan sends that URL and the selected scan level; the backend then audits the public page. Task and mute actions send the selected finding, page URL and text you provide. By default, page URLs exclude query parameters and fragments. In Settings, you can consent to sending selected parameter names and their current values for an exact site origin. Save confirms the choice; removing it and saving withdraws consent for future requests. Known credential, personal-data and tracking parameters remain excluded. A cloud scan is blocked when removing parameters would change the page being audited. Use the local audit for pages whose identity depends on personal data or secrets.

On request, Lens checks six accessibility rules in the current browser tab, including pages behind a login. The page content and full URL stay in your browser. Results stay in extension memory for up to ten minutes. To save a result in Insight, you must choose a project and agree to each export. The export contains the site origin, keyed fingerprints of the page, named state, role and affected elements, rule outcomes, browser and viewport details, language and capture time. Insight also records the project, workspace and account that sent it and removes the observation after 30 days. This is a user-reported observation, not a cloud score or proof of WCAG compliance.

Browser metrics are optional. On first launch you can allow them or use the extension without sending them. Declining does not block reports, the side panel, inspector, or fix snippets.

You can change this later in extension settings. After metrics are turned off, the extension does not send further browser measurement data.

When metrics are enabled, the extension collects technical data about the audited page:

• Page performance metrics (LCP, INP, CLS, FCP and TTFB)
• Counts of JavaScript-accessible cookies by category
• Third-party request counts and transfer size, when available, by resource category
• Cookie names and third-party resource addresses are used locally for categorization; they are not sent
• Audited page URL without query parameters, fragment, or credentials
• Date and time of the measurement

Optional browser measurements do not include cookie names or values, page form contents, or values typed into the inspected page's input fields. Account authentication and task text are described separately above.

Data is used to enrich the page quality audit with measurements from a real browser and to associate those measurements with the user's CometWeb project.

Metrics are sent over an encrypted connection only to the CometWeb backend. The production address is https://app.cometweb.io. The API key is kept in extension-origin storage and is never sent to the audited page.

HTML fix previews are sanitized. Scripts, forms, event handlers, inline styles, and attributes that could fetch external resources — such as src, srcset, and href — are removed.

Page tools inspect the current DOM locally. The extension does not upload the whole DOM or your local HTML/CSS previews. Your API key stays in extension-origin IndexedDB; settings stay in local extension storage and report cache entries expire after five minutes. Removing the key clears cached results and scan polling. Uninstalling removes local extension data; cloud reports belong to your Insight account and must be managed there. Private browsing is not supported. An unresolved scan also keeps its retry identifier and a hash of the page address in local storage, so a retry after a browser restart can reuse the same operation. The extension removes this entry after confirming that the scan was accepted. An active scan also keeps its identifier, page address and progress state locally so tracking can resume after a browser restart. The finished state remains available for five minutes. Removing the API key removes the stored scan tracking state. Site consent stores the origin and selected parameter names locally, without their values. Changing consent clears cached reports but keeps unresolved scan retry identifiers and active scan tracking.

Data is used to provide reports, cloud scans, task actions and optional page measurements. CometLens does not sell browsing data, use it for advertising, or transmit it to a separate analytics service. Its use of data is limited to the stated features. Account data and server-side retention are covered by the full CometWeb privacy policy.

For access, rectification, or deletion requests, use app.cometweb.io/profile or email hello@cometweb.io.

The full privacy policy is available at cometweb.io/legal/privacy.