Privacy policy

Last updated: 2026-10-26

Who we are

The controller of your data is Your legal name, street, city, country. Contact: privacy@firstino.io. Our servers are hosted by Hetzner Online GmbH in the EU.

What the browser extension collects

Only after you give consent in the extension, and only about public websites:

The address of the page (domain and path). Query strings and fragments are removed before anything leaves your browser, so search terms, tokens and form data are never sent.
Technologies detected on the page (for example "WordPress" or "jQuery 3.7") and the technical signals our server needs to recognise them: the addresses of scripts and other resources the page loads, its meta tags, the names (never the values) of its cookies, and whether certain page elements and JavaScript variables are present.
The external links on the page (their addresses and link text), which we use to map which websites link to which.
A random install ID generated by the extension. It is not linked to your name, email, Google account or device.
Your country, derived from your IP address when the request arrives. The IP address itself is never stored.

We never collect form input, passwords, cookie values, or anything from private addresses (localhost, IP addresses, intranet hosts) or incognito windows. The version published in the Chrome Web Store never sends the page's text or HTML; only our own staff and ambassador builds do, so our server can recognise more technologies.

The version published in the Chrome Web Store sends data only when you click the extension button on a page.

Why, and on what legal basis

To show you the technologies a site uses and to build aggregate statistics about websites. The legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time in the extension settings.

Ambassadors

Ambassadors are people we pay to collect data. Their extension records every public website they visit, linked to their ambassador account, so we can count the websites for their monthly payment. We store their name, optional email and the websites they visited per month, under a separate ambassador agreement (legal basis: contract, GDPR Art. 6(1)(b)). They can pause recording at any time.

Website language and contact emails

For each website we record the language it declares and its other language versions. We also record contact email addresses a website publishes on its own domain (for example info@example.com), from its pages and contact or imprint pages. Addresses on other domains, such as personal webmail, are ignored. These emails are never shown on our public pages. Where an address identifies a person (for example jane.doe@example.com) it is personal data: we process it on the basis of legitimate interests (Art. 6(1)(f) GDPR) in maintaining business contact information, and you can ask us at any time to delete it or object to its use by writing to the contact address below.

Our crawler

We also visit public websites ourselves to detect technologies. Our crawler identifies itself in its user agent and obeys robots.txt and Crawl-delay. Apart from the business contact emails described above, it does not collect personal data.

Retention

Per-install statistics (which sites an install checked and how often) are kept while the install is active and deleted when you delete your data or after 24 months of inactivity. Statistics about websites are anonymous aggregates and are kept indefinitely.

Your rights

You can access, export and delete the data linked to your install ID at any time from the extension settings ("Export my data" and "Delete my data"). You also have the right to rectification, restriction, objection and to lodge a complaint with your data protection authority.

Sharing

We do not sell or share data linked to an install ID. We may provide aggregate, anonymous information about websites (for example which technologies a domain uses) to third parties.