This policy covers the Pharos Chrome extension, the optional Pharos alpha service, and trypharos.app. Pharos is in closed alpha. The Pharos developer operates the website and alpha service. For privacy questions or a data request, contact support@trypharos.app.
Pharos checks for phishing pages, scareware, payment scams and suspicious downloads. Some checks run in your browser. When online checking is configured, other checks send a screenshot and page details to external services. Visual checks use cloud services.
At a glance
- Local URL checks and caches help avoid unnecessary online checks.
- Online checks send the visible page screenshot, URL and title. These can contain personal or sensitive information. Screenshots are not automatically redacted.
- Direct mode uses your own provider accounts. Alpha mode routes checks through the Pharos service using the developer's provider accounts.
- Pharos does not sell browsing data, use it for advertising, or train models on it. Provider data handling is explained below; it varies by service and account settings.
- This website has no analytics scripts, advertising trackers or third-party embeds. Cloudflare still processes ordinary network requests to serve and secure the site.
1. Information the extension reads
| Information | Use |
|---|---|
| Page URL and title | Check top-level pages against local threat feeds and URL rules; provide context for online checks when needed. A URL can include personal information in its path or query string. |
| Visible page text and inline scripts | Create a local content fingerprint, recognize browser/security interstitials, and detect substantial changes. The raw text and full HTML are not sent to the model services. |
| Visible page screenshot | Check unfamiliar pages that reach the vision stage, when online checking is configured and the tab is visible. A screenshot can be taken again after significant page changes or a manual rescan. |
| Page behavior | Detect changes such as overlays, fullscreen entry and repeated dialogs; decide whether to rescan or close a tab that is repeatedly opening dialogs. |
| Download URL and file name | Check downloads against local threat lists and file-name rules. Suspicious downloads can be paused for your decision. Downloaded file contents are not uploaded for analysis. |
What a screenshot can reveal. It may show email, messages, account names, health or financial information, images, and text you have entered if it is visible on screen. Pharos does not directly read password/input values or record keystrokes, but it does not mask sensitive pixels before sending a screenshot. Local visible-text processing may also encounter text displayed in editable page content. Do not enable online checks in a browser profile where this sharing would be inappropriate.
Pharos does not read website cookies, website local storage, or the Chrome browsing-history database. This does not make screenshots or individual checked URLs anonymous. Pharos does not continuously record your screen.
2. Direct mode: your provider accounts
Direct mode is the default. Requests go from your browser to services using the credentials you configure; the Pharos developer does not receive these checks through a Pharos server.
| Recipient | Information received | When |
|---|---|---|
| Cloudflare Workers AI, running Clef | Screenshot, page URL, hostname, title and checking instructions | A page reaches the vision stage. Screenshots are normally resized to at most 1280 pixels wide; if resizing fails, the original capture may be used. |
| Your selected arbiter: OpenAI, Anthropic, Google Gemini or xAI | The same screenshot and page details, plus Clef's scores and checking instructions | Clef's result meets the configured double-check rules. This stage is skipped when disabled or not configured. |
| URLhaus, OpenPhish, and PhishTank if configured | Requests for threat-list downloads; a PhishTank key is included in its download request | Installation, periodic refreshes and manual refreshes. The visited page URL is not sent to these feed publishers. |
| Connected checking services | The Pharos icon and an example.com test URL | You run a connection test. |
Recipients receive network information, such as your IP address, as part of these connections. The arbiter does not receive a separate copy of the page's DOM text.
3. Alpha mode: the Pharos service
You select Alpha tester mode and enter an invitation token to use the developer's checking accounts. Screenshot and arbiter requests then pass through the Pharos backend at api.trypharos.app, hosted on Cloudflare Workers, before going to Cloudflare Workers AI and OpenAI or Anthropic. The browser sends your tester token with each request. Periodic quota checks also send that token.
Information held by the alpha service
Cloudflare D1 stores the invitation token, the name and email entered when you are invited, creation date, activation status and budget. It also stores per-call model and usage metadata, estimated cost, latency, errors and daily usage summaries. This information is linked to your tester record; it is not anonymous. It supports access control, budgets, reliability and alpha support.
The application does not write routine scan screenshots, page URLs or titles to D1. It processes them in transit for the checking services. This is not a promise of zero retention by hosting infrastructure or model providers.
Optional diagnostics and reports
Switching to Alpha mode turns on “Help improve Pharos.” You can turn it off in Settings → Privacy. While on, the extension uploads diagnostic counts, panic events and backend-health information about once a minute or after enough events accumulate. If you select “Pharos got this wrong,” the report also includes that page's URL, title and verdict. Ordinary aggregate counts do not contain screenshots or page content.
The developer can review alpha records in an authenticated dashboard. If the optional weekly email digest is configured, it is sent through Resend to the developer and can include reported page URLs and titles. Treat a submitted report as information you are sharing for support and accuracy review. Routine per-call billing and operational records are still created when optional diagnostics are off.
Retention and leaving the alpha
The alpha service's retention commitment is to delete tester records, events and daily summaries within 30 days after the alpha ends, or handle an earlier deletion request. This is an operator-managed process; the current backend does not schedule automatic expiry. The alpha has no fixed end date. Hosting backups, provider records and copies of emails have separate retention rules; deleting a D1 record does not automatically erase them.
To stop future requests through Pharos, switch to Direct mode or disable/uninstall the extension. That does not erase records already received. Contact support to request deletion. If your token reaches its budget, online alpha checks pause; local protections remain available.
4. Provider processing, training and location
Pharos does not train or fine-tune models using your browsing data. Sending information for inference is still processing by another provider. Account choices, optional data-sharing settings, safety review and legal obligations can affect how that provider handles it.
- Cloudflare Workers AI: its published policy says customer content is not used to train models or improve services without explicit consent. Additional storage services have their own handling. Workers AI data usage.
- OpenAI API: API inputs and outputs are not used for model training by default. Standard abuse monitoring may retain content for up to 30 days, with safety, legal and feature-specific exceptions. Pharos does not promise an approved zero-retention arrangement. OpenAI API data controls.
- Anthropic API: no model training by default; standard API inputs and outputs are normally deleted within 30 days, with exceptions including safety enforcement, legal obligations and agreed arrangements. Training and retention.
- Google Gemini in Direct mode: paid-service terms exclude use of prompts and responses for product improvement, but unpaid-service terms may allow it and human review. Google's unpaid-service terms prohibit submitting sensitive, confidential or personal information. Because browser screenshots can contain that information, do not use an unpaid Gemini account for Pharos page checks. The extension does not verify your billing status. Gemini API terms.
- xAI API in Direct mode: the published API policy says inputs and outputs are not used for training without permission and describes standard 30-day retention for abuse auditing. API security and retention.
Services can process information outside your country. Pharos does not configure a country-specific processing region or promise that data stays in your jurisdiction. Direct-mode provider accounts are yours to manage; contact those providers for their account controls. For alpha-service questions about recipients, locations or applicable transfer arrangements, contact support. No unverified contractual safeguards or compliance certification are represented by this policy.
5. Information stored in your browser
Pharos uses extension storage in the current browser profile, not Chrome account sync.
| Information | Retention and controls |
|---|---|
| Settings, provider credentials, alpha token and onboarding progress | Until changed, Reset Pharos or uninstall. Switching modes keeps credentials for the other mode. |
| Content-fingerprint verdicts and current tab state | Session storage; normally cleared when the browser session ends. Tab records are removed when their tabs close. |
| Screenshot-fingerprint cache, including URL and verdict | Up to 2,000 entries. Verdicts expire after 24 hours; expired stored entries are removed on subsequent cache writes or Reset Pharos. |
| Downloaded threat lists | Replaced on refresh. |
| Debug scan log | Last 1,000 entries, until cleared, reset, uninstalled or displaced. Developer mode records URLs, titles, verdicts, small screenshots, model answers and errors. Turning the mode off stops ordinary recording; it does not clear past entries. |
| Reports you create and backend-mode changes | Recorded in the same local log even with developer mode off. |
| Optional local diagnostic counts | A rolling 90-day window, pruned when new records are added; older counts can remain if counting stops. Erase telemetry removes local counts. |
| Pending alpha uploads | Up to 500 queued events until sent or dropped. Switching to Direct mode clears the queue; disabling diagnostics stops uploads and clears pending events on the next upload check. |
Stored API key values are scrubbed from log text before saving and exporting. This cannot remove personal information or secrets visibly present in a screenshot or embedded in a page URL. Review exported logs before sharing them. Keys in extension storage are protected by your browser and operating-system access controls; Pharos is not a password vault.
6. Website visits and support
The website is static and all page assets are self-hosted. Pharos adds no analytics scripts, tracking pixels, advertising cookies or third-party embeds. Hosting and security providers still receive request information such as IP addresses, requested URLs, browser/network headers and timestamps. See Cloudflare's privacy policy for its processing.
If you email support or request an invitation, we receive your address and whatever you send. We use those messages to respond, administer invitations, investigate reports and resolve requests. Email providers process the messages too. Please avoid sending passwords, API keys, full browsing logs or unnecessary personal information. Resend's privacy policy applies when its optional alpha digest is used.
7. Your choices and privacy requests
- Stop optional diagnostics: untick Help improve Pharos. In Direct mode counts are local and only leave if you share an export. In Alpha mode this stops future optional uploads, not operational records or existing server data.
- Limit online checks: turn the arbiter off to stop that stage. To stop all screenshot checks, use Direct mode without Cloudflare credentials, or disable the extension. Emptying your own Cloudflare credentials while Alpha mode remains active does not disable its hosted checks.
- Inspect, export or erase local data: use Settings → Debug for the log, Settings → Privacy for counts, or Reset Pharos to clear extension storage and restart setup. Erase telemetry clears local counts, not previously uploaded records or the pending upload queue. Uninstalling removes extension storage but not exported files or server records.
- Request help with server-held information: email support@trypharos.app. Identify the invitation email or other information sufficient to locate your record; do not send an API key or full alpha token. We may need proportionate verification before disclosing or deleting records.
Depending on applicable law, you may have rights to know or access your personal information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent where processing relies on it, or complain to a privacy regulator. California residents may also have rights concerning sale or sharing and sensitive personal information. Pharos does not sell personal information or share it for cross-context behavioral advertising and does not penalize requests to exercise applicable rights. This policy does not claim that every law or right applies in every situation.
Pharos uses automated checks to issue warnings, hold suspicious downloads and sometimes block or close pages. They can be wrong. You can rescan and report a mistaken result, and contact support for review.
8. Limited use, security and children
Pharos limits its use of information received from Chrome APIs to providing and improving its browser-security features. The Chrome Web Store User Data Policy, including its Limited Use requirements, governs this use. It is not used for advertising, data brokerage, creditworthiness or lending decisions. The developer reviews information you intentionally share for support or reporting, and operational records needed to run the alpha. It does not routinely inspect the content of your page screenshots.
Network calls use HTTPS. Access to the alpha dashboard requires authentication. These safeguards reduce risk; they are not a guarantee against every breach. Report a vulnerability to security@trypharos.app.
Pharos is not directed to children. If you believe a child has provided personal information to the Pharos operator, contact support so it can be investigated and deleted where appropriate.
9. Changes
We will update the effective date when this policy changes and communicate material changes to alpha testers before they take effect. Contact support if a notice or the behavior you observe appears inconsistent with this policy.