Privacy Policy — SaaS Made Free browser extension

Last updated: 2026-07-30

Short version: this extension reads the address (hostname) of the page you are on, and nothing else — it never reads a page's content, form fields, or cookies. When it recognizes a page, it writes exactly one thing to it: its own small panel, self-contained inside a closed Shadow DOM, which cannot read or change anything already on the page. The only thing it ever sends over the network that you initiated is a vote — a single tool name, no personal data attached. There are no cookies, no trackers, and no analytics in the extension. Nothing is sold or shared.

What this extension is

SaaS Made Free is a directory of SaaS subscriptions that can be replaced with a self-hosted alternative built by a coding agent. The browser extension recognizes when you land on the website of a tool that is in the directory and shows you a small, dismissible panel with that tool's entry: whether it can be replaced, roughly what it would cost you in time, and a ready-to-use prompt.

What the extension reads from pages you visit

The extension reads exactly one piece of information from the page you have open: its hostname (for example notion.so). It compares that hostname against a list of known tools.

It does not read the text, images, or structure of the page.
It does not read form fields, passwords, or anything you type.
It does not read cookies, local storage, or session data belonging to the site you are on.

What the extension writes to pages you visit

Reading the hostname is the only thing the extension does on every page. If — and only if — that hostname matches a tool in the directory, it writes exactly one thing to the page: its own small, dismissible panel. That panel is rendered inside a closed Shadow DOM, a self-contained element isolated from the rest of the page. It does not read or modify anything that was already on the page, and the page's own scripts cannot see or reach inside it. If the hostname does not match, nothing is written at all.

What leaves your device

The extension makes network requests in two situations, both described below in full. There is no third case.

Feed refresh (automatic, no personal data). Once a day, the extension fetches a small public data file (the directory of tools, prices, and prompts) from this website. This is a plain read of a public file — it does not identify you, and it does not include the hostname of any page you visited.
Voting (only when you click "I'll do it myself"). If you choose to record that you replaced a tool, the extension sends the tool's identifier (for example notion) to our voting service. That request carries no name, email, account identifier, or page content — only the tool identifier. If you are offline at that moment, the identifier is queued locally instead, and sent the same way the next time the extension starts up or runs its daily refresh — see "Local storage on your device" below.

How a vote is protected

A vote request necessarily arrives from your IP address, the way any network request does. Before anything is written to storage, our server hashes that IP address together with the day and a secret key that only the server holds and that is never published. The raw IP address is never written to disk in clear form — only the resulting hash, alongside the tool identifier and the day. This lets the server enforce "one vote per tool per day" while keeping the stored hash impossible to reverse back to your IP address without that key.

What we don't do

No cookies.
No trackers or analytics of any kind inside the extension.
No account, sign-in, or persistent identifier tied to you.
No selling, renting, or sharing of any data with third parties.
No reading of page content, form fields, or cookies belonging to other sites.
No modification of anything already on a page — the only thing ever written is our own isolated panel, described above.

Local storage on your device

The extension stores four things locally in your browser, using Chrome's standard extension storage. Three of them are settings that never leave your device: which tool panels you've dismissed, your language preference, and, if you choose to add one, your own custom agent template. None of those three are transmitted anywhere, including to us.

The fourth is different, on purpose: a small queue of votes cast while you were offline. It holds the tool identifier (for example notion) for each vote that couldn't reach our server right away. The extension retries automatically — the next time it starts up, or at the next daily refresh, whichever comes first — sending exactly those identifiers to our voting service, the same request described above under "What leaves your device," nothing more. Each identifier is removed from this local queue once it has been sent successfully.

Why the extension asks for broad permission

When you install this extension, Chrome shows a warning that it can "read and change data on all websites you visit." This permission exists for one reason: so that a new tool added to the public directory is recognized by every already-installed copy of the extension, the next time it refreshes its data — without you having to install an update. The extension's code that runs on a page you visit only ever compares the page's hostname against that list, and, only on a match, writes its own isolated panel described above; it never reads or changes anything else on the page. See "Auditability" below for how to verify this yourself.

The specific browser permissions requested, and why:

host_permissions: <all_urls> — needed to run the content script described above (read the hostname, and on a match write the panel) on any site, so newly added tools work without a new extension release.
clipboardWrite — used only when you click a button to copy a prompt to your clipboard.
storage — used only for what's described in "Local storage on your device" above.
alarms — used only to schedule the once-a-day feed refresh described above.

Auditability

This extension is open source. The source code, including the exact file described above, is public and can be read, built, and compared against the version published in the Chrome Web Store.

Only one file in the extension ever runs on the pages you visit: extension/content.js. It reads only location.hostname from the page — never its content, its forms, or its cookies — and makes no network request of its own. The one thing it writes, and only on a hostname match, is its own panel element, self-contained inside a closed Shadow DOM: it does not read or modify anything already on the page. This is a short file and a ten-second read for anyone who wants to verify both claims directly.

Children's privacy

This extension is not directed at children and does not knowingly collect any data from anyone, of any age, beyond what is described above.

Changes to this policy

If this policy changes, the "Last updated" date at the top of this page will change accordingly. Because this page is part of a public, versioned repository, past versions of this policy remain visible in its history.

Contact

Privacy questions, or anything about the data described above: privacy@saasmadefree.com.