Browser extension privacy policy

Effective 2026-07-25.

This policy covers the Bramble extension for Chrome, Edge, Brave, and other Chromium browsers. Bramble is a recovery tool, and this page is written to be checked rather than trusted: it names every request the extension makes to Bramble’s servers, and what is inside it.

What runs in your browser and stays there

• Site blocking. The blocklist ships inside the extension and is enforced by the browser’s own rule engine. Bramble is not asked about the sites you open.
• Image and video filtering. An image stays hidden until a classification model bundled with the extension returns a verdict. (Some pages are skipped outright — a curated set of business and workplace tools, where the filter never arms.) The model and the runtime that executes it are both inside the extension package; no code is downloaded to run them.
• Page screening. A second bundled model reads the page’s title, description, first heading, and roughly the first 500 characters of visible text to judge whether the page itself is pornographic. That text is used in your browser and is never transmitted.
• Feed redirects. Instagram Explore and Reels, TikTok’s For You feed, X’s Explore tab, Reddit’s r/all and r/popular, and Tumblr’s Explore page are redirected to the followed or home equivalent. The decision is made from the address in your address bar, inside your browser. Setting your protection level to Light in the Bramble app turns this off.

What the extension sends to Bramble, and when

Nothing is sent to Bramble until you pair the extension with your Bramble account. Pairing is the consent moment: the extension asks Bramble for a one-time code, sending only a browser label such as “Chrome on macOS”, and you confirm that code inside your own iOS app. After pairing:

1. A second opinion on an image. When the on-device model cannot reach a confident verdict, two things are sent to Bramble’s backend, which passes them to Anthropic (see Who else handles this) to classify: the image’s own web address, and a downscaled copy of the image itself — at most 1024 pixels on its longest side, re-encoded as a JPEG from the copy your browser had already downloaded in order to show it to you. Sending the picture, and not only its address, is what makes a verdict possible at all on the many sites that will serve an image to your browser and to nobody else; before this, those images simply stayed hidden with no answer. Bramble does not store the copy — it is used for that one decision. The verdict is cached against a SHA-256 hash of the address, not the address itself.
2. A second opinion on a video. For a video the on-device model cannot call, 2–6 sampled still frames are sent as image data, together with the hostname of the page the video is on and hashes that identify the clip. The frames are used for that one decision and are never stored. The resulting verdict is stored against the clip’s hash and that hostname, with no link to you, and expires after seven days.
3. Blocked-site signals. When the extension blocks a site, its domain is hashed (SHA-256) in your browser and only the hash is uploaded, linked to your account. The final verdict on an image is reported the same way — the hostname hashed, plus the verdict, which tier decided it, and a confidence number. These signals are what let one man’s block strengthen protection for the next.
4. Account and channel reputation. On social platforms the extension checks the reputation of the account behind a post, and on YouTube the channel behind a video, so a known adult creator can be hidden before their content loads. The account handle, the platform, and any account or channel id are sent unhashed — the server has to look them up. When content is blocked, the same identifiers go back as a signal. If a profile’s bio links to a link-aggregator page, that link is sent to Bramble so the server can follow it and see whether it leads to a paid adult account; when it does, the aggregator’s own list of that creator’s other accounts is reported too. No bio text, display name, or profile photo is transmitted.
5. Reporting a site Bramble got wrong. The “Flag this site” control in the extension’s popup sends the current site’s hostname unhashed, plus the reason you pick. It has to be unhashed — we cannot act on a hash.
6. Your answer when Bramble asks how you’re doing. If Bramble blocks a hard-blocked adult site and asks whether you’re struggling, your answer is uploaded with that site’s hostname and its category. The server checks the request came from a real Bramble user and then deliberately stores no account id alongside it.
7. Extension health diagnostics. Counts of heartbeats, configuration failures, content-script re-injections, and errors; up to three error messages with any web addresses stripped out; your protection level; whether you have allowed the extension in incognito windows; and the extension’s version number.
8. Configuration requests. The extension periodically fetches your own protection settings, authenticated by a device credential created at pairing. It also downloads an updated block list from Bramble’s public storage — that is a download, and nothing about you rides along with it.
9. An uninstall beacon. While paired, the extension asks your browser to open one Bramble address if you ever remove the extension. That request carries only the device credential — no browsing data of any kind. It exists so Bramble can retire this browser and, if you have a Circle, tell them this screen is no longer covered; on Windows and Linux the extension is the only Bramble layer, so its removal is the only thing there is to notice. Unpairing clears the beacon.

What never leaves your browser

• The address of the page you are on — not its path, not its query string. What can leave is a hostname, in the cases named above; the address of an individual image; and a link found in a creator’s public profile.
• The text of the pages you read.
• Form data, keystrokes, passwords.
• The images you see, with two exceptions, both named above: a downscaled copy of a single image the on-device model could not settle (item 1), and the 2–6 sampled video frames (item 2).
• Anything at all before you pair, apart from the browser label in the pairing request itself.

Who else handles this

Bramble’s backend runs on Supabase. The two classifications that cannot be made in your browser — the image and video second opinions above — are performed by Anthropic (Claude) acting as Bramble’s processor, solely to return a classification.

Your data is never sold. Apart from the processors named above it is not shared with third parties, and it is used only to provide and improve Bramble’s protection. Bramble is free; you are not the product — the shared fight is the point.

What your Circle sees

If you use Bramble’s Circle (accountability) features, the people walking with you see coverage status — that this browser is protected, that it went quiet, that the extension was removed, or that incognito windows aren’t covered yet. They never see what you browse, what was blocked, or any domain.

Retention and deletion

• Blocked-site and image-verdict signals are stored as SHA-256 hashes linked to your account. How much a signal influences Bramble’s classification halves roughly every 14 days — that is a weighting applied when the signal is read, not a deletion. The underlying records are kept while your account exists.
• Deleting your Bramble account, from the iOS app, deletes your account and the records keyed to it. Image-verdict signals are deleted outright; hashed blocked-domain records are kept but permanently unlinked from you.
• Records that were never linked to you — the fleet video-clip verdicts and the “are you struggling?” answers — are unaffected by deletion, because there is nothing in them that identifies you.
• Unpairing this browser (Bramble iOS app → Settings → My Screens → retire the browser) immediately revokes its credential, and the revoked credential is refused everywhere afterwards, so a copy of it cannot be reused.

Contact

Questions: luke@getbramble.app