CiteSig Verifier · Privacy
Nothing leaves your browser.
The CiteSig Verifier extension performs every signature check locally. There is no server, no telemetry, no analytics, no account.
Plain-English summary. The CiteSig Verifier extension does not collect, transmit, store, sell, or share any of your personal data. It performs signature verification entirely inside your browser. It makes zero network requests to CiteSig, DeepInquiry, Epic Sky LLC, or any third party. There are no analytics, no telemetry, no crash reports, no user accounts, and no advertising.
What the extension does
When you visit a web page, the extension's content script scans the page's DOM for HTML elements with a data-citesig attribute — the CiteSig attestation format. For every attestation it finds, it:
- Parses the attestation locally using JavaScript.
- If the attestation includes a
did:key:signer, decodes the public key from the DID (this is a pure math operation — no network call). - Verifies the Ed25519 signature using the browser's built-in WebCrypto API.
- Renders a small colored badge next to the claim indicating verification status.
When you click a badge, the extension displays an inspector panel showing the claim text, signer identifier, timestamp, and source list — all read from the attestation already present on the page.
What data the extension accesses
- Page content, current tab only. The extension reads the DOM of the page you are currently viewing to find attestations. It never reads other tabs, browsing history, cookies, form data, passwords, or files. It uses the Chrome
activeTabpermission, which restricts access to the tab you have focused and only when you interact with the extension (opening the popup or clicking a badge). - Nothing else. The extension does not have
<all_urls>host permissions, does not usestorage, does not usetabs.queryfor other tabs, does not usewebRequest, does not usecookies, and does not useidentity.
What data leaves your browser
Nothing. The extension makes no HTTP, HTTPS, WebSocket, or any other network requests to any server. All signature verification uses locally computed WebCrypto operations against public keys extracted from the attestation itself. There is no server component to CiteSig Verifier v0.1.x.
Links inside the inspector panel (to source URLs, signer URLs, or the CiteSig homepage) open in a new tab only when you click them, using standard browser navigation — the same as clicking any link on any web page.
What data we collect
None. Epic Sky LLC operates no server, endpoint, or logging infrastructure that receives data from this extension. We have no way to identify you, count installs, measure feature usage, or observe your behavior through this extension. We do not receive Chrome Web Store analytics beyond aggregate install counts that Google publishes to all extension developers.
Third parties
The extension bundles no third-party analytics SDKs, no advertising SDKs, no error-reporting SDKs, and makes no calls to any third-party service. The only external dependency is the browser's own WebCrypto API, which is a W3C standard implemented by the browser vendor (Google Chrome, Microsoft Edge, Brave Software, etc.).
Permissions we request and why
The extension's manifest.json requests exactly one permission:
activeTab— required to read the DOM of the current tab to find attestations. Without this permission the extension cannot function.activeTabis scoped to the tab you are currently viewing and does not grant access to other tabs, other windows, or your browsing history.
The extension also uses content_scripts matching <all_urls> because attestations may appear on any web page. This is scoped injection (the content script runs on the page you visit), not a broad host-permission grant (the extension cannot read tabs you are not visiting or make cross-origin requests on your behalf).
We do not use permissions.request to escalate at runtime.
Children
The extension is not directed at children under 13 and does not knowingly collect any data from anyone of any age.
Changes to this policy
Because the extension collects no data, we do not anticipate substantive changes. If a future version adds any new behavior that could affect what data the extension accesses or transmits (for example, adding an HTTPS signer resolver in v0.2, which would need to fetch signer public keys from URLs the attestation itself declares), we will update this policy and note the change in the version history below before publishing the new version.
Contact
- Questions about this policy or the extension: [email protected]
- Security disclosures: [email protected]
- Source code and issue tracker: github.com/citesig/verifier-extension
Version history
- September 8, 2026 — initial publication covering CiteSig Verifier v0.1.2.