Privacy Policy
Effective Date: March 21, 2026
This Privacy Policy describes how Hung Nguyen, operating as HForgeX ("we," "us," or "our"), collects, uses, shares, and protects information when you use our Chrome browser extensions, website (hforgex.com), License Portal (portal.hforgex.com), and related services (collectively, the "Services").
We are committed to protecting your privacy. Our extensions are privacy-first by design — they process data locally in your browser and do not transmit your content to our servers.
1. Data Controller
The data controller responsible for your personal data is Hung Nguyen, a sole proprietor operating as HForgeX. For privacy inquiries, contact us at:
Email: [email protected]
Website: https://hforgex.com
2. Information We Collect
2.1 Information You Provide
| Data Category | What We Collect | When |
|---|---|---|
| Purchase Information | Email address, order ID | When you purchase a Pro license |
| License Activation | License key, device code (UUID) | When you activate Pro in an extension |
| Support Requests | Email address, message content | When you contact support |
2.2 Information Collected Automatically
| Data Category | What We Collect | Purpose |
|---|---|---|
| Website Analytics | Page views, referral source, country (anonymized IP via Google Analytics 4) | Understand website usage |
| License Status Checks | License key, device code | Verify license validity and detect refund revocations |
2.3 Information We Do NOT Collect
- Extension content — Screenshots, OCR text, URLs, and any user content are processed entirely locally in your browser. We never receive, store, or transmit this data.
- Browsing history — Our extensions do not access or track your browsing activity.
- Payment details — Credit card numbers and billing details are processed directly by LemonSqueezy and never touch our servers.
- Extension telemetry — We do not collect usage analytics from within our extensions.
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
| Processing Activity | Legal Basis |
|---|---|
| License delivery and activation | Contractual necessity (Art. 6(1)(b) GDPR) |
| License status verification | Legitimate interest (Art. 6(1)(f) GDPR) |
| Website analytics (GA4) | Consent (Art. 6(1)(a) GDPR) |
| Customer support | Contractual necessity / legitimate interest |
| Fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
4. How We Use Your Information
- License fulfillment — Deliver license keys, verify activations, manage device bindings.
- Customer support — Respond to support requests and resolve issues.
- Service improvement — Analyze anonymized website traffic to improve our products and content.
- Security — Detect and prevent fraud, abuse, and unauthorized license usage.
- Communication — Send essential transactional communications (purchase receipts, license delivery). We do not send marketing emails without your explicit consent.
5. Data Sharing
We do not sell, rent, or trade your personal data. We share data only with the following third-party service providers who assist in operating our Services:
| Provider | Purpose | Data Shared |
|---|---|---|
| LemonSqueezy | Payment processing | Email, payment details (they are the processor) |
| Cloudflare | Hosting, CDN, Workers (License API) | IP address (for CDN), license verification requests |
| Google Analytics | Website analytics | Anonymized IP, page views, referral data |
Each provider processes data under their own privacy policies and applicable data protection agreements.
6. Data Retention
| Data Category | Retention Period |
|---|---|
| License records (email, key, devices) | Duration of license validity + 1 year |
| Purchase records (order ID) | As required by tax/accounting laws (typically 7 years) |
| Support correspondence | 2 years from last interaction |
| Website analytics | 26 months (GA4 default) |
7. Your Rights
7.1 GDPR Rights (EEA, UK, Switzerland)
If you are located in the EEA, UK, or Switzerland, you have the right to:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Request correction of inaccurate data.
- Erasure — Request deletion of your personal data ("right to be forgotten").
- Restriction — Request restriction of processing in certain circumstances.
- Portability — Receive your data in a structured, machine-readable format.
- Objection — Object to processing based on legitimate interests.
- Withdraw Consent — Withdraw consent at any time where processing is based on consent.
To exercise these rights, email [email protected]. We will respond within 30 days.
7.2 CCPA Rights (California)
If you are a California resident, you have the right to:
- Know — What personal information we collect and how we use it.
- Delete — Request deletion of your personal information.
- Opt-out of sale — We do not sell personal data. No opt-out action is needed.
- Non-discrimination — We will not discriminate against you for exercising your rights.
8. Cookies & Local Storage
8.1 Website Cookies
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential | Theme preference (dark/light mode) | Persistent (local storage) |
| Analytics | Google Analytics 4 (anonymized) | Up to 2 years |
8.2 Extension Local Storage
Our extensions use Chrome's local storage APIs (chrome.storage.local) to store your preferences, settings, and license data. This data stays on your device and is never transmitted to our servers, except for license verification requests (license key and device code only).
9. International Data Transfers
Our Services use infrastructure providers (Cloudflare, Google) that may process data in countries outside your jurisdiction. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
10. Children's Privacy
The Services are not directed to children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will promptly delete such data.
11. Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit — All communications use HTTPS/TLS.
- License signing — Ed25519 cryptographic signatures for license integrity.
- Minimal data collection — We collect only what is necessary.
- Access controls — Restricted access to personal data on a need-to-know basis.
- Local-first architecture — Extension data processing happens in your browser.
No system is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.
12. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Art. 33).
- Notify affected individuals without undue delay if the breach is likely to result in a high risk (GDPR Art. 34).
13. Privacy by Design
HForgeX extensions are built with privacy by design principles:
- 100% local processing — Screenshots, OCR, annotations, and URL editing happen entirely in your browser.
- No cloud dependency — Core features work fully offline.
- No user accounts — Minimal identity footprint.
- Minimal permissions — Each extension requests only the Chrome permissions it needs.
- No tracking inside extensions — Zero telemetry or usage analytics within extensions.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. We encourage you to review this Policy periodically. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.
15. Contact Us
For privacy-related questions, data requests, or concerns, contact us at:
HForgeX — Privacy
Email: [email protected]
Website: https://hforgex.com