SpotBack privacy policy
Last updated: 21 October 2026
SpotBack has no server, no accounts, no analytics, no ads, and makes no network requests. All data stays in your Chrome profile. Uninstalling the extension deletes it.
What is stored
Per remembered page (at most 300 pages and 30 days by default; you can change both in Settings):
| Data | Why |
|---|---|
| Page address, with tracking parameters (utm_*, fbclid, gclid, ...) and parameters that look like secrets (token, session, key, code, ...) removed; credentials and most fragments removed | Identify the page |
| Page title and domain | Show "Recent places" |
| Scroll position, document height, progress, timestamp | Restore your position |
| The last link you clicked: its address, a stable site id (for example an Amazon product number), a selector made only from id/data attributes, up to about 120 characters of its link text, and its on-screen offset | Find and mark the item you opened |
| Nested scroll area selector and offset (if any) | Restore that scroll area |
Settings (switches, theme, excluded sites, retention) are stored too. A short-lived per-tab copy of the position is kept in the page's sessionStorage (key __spotback_tab_v1); scripts of that website can read it.
Temporary "where did I come from" record (Back to results)
So that a page on another website can offer "Back", SpotBack keeps one small record per open tab in the extension's session storage: the full address of the page you clicked a link on (needed to load it again), its title and host, the site-adapter id (for example amazon) and a timestamp. For a link opened in a new tab it also holds the id of the opener tab and a short description of the clicked item (its link address, a short piece of its text and its position), so each tab returns to its own item. This record is held in memory only: it is never written to disk, never leaves your device and disappears when the browser closes. It is limited to 20 tabs and 6 hours, and is deleted when the tab closes, when you move on to a third website, or when you use "Back". Nothing is recorded while SpotBack is paused, on excluded sites, or where Chrome has not given SpotBack access.
What is never collected
Page text, form fields, passwords, keystrokes, cookies, screenshots, browsing history beyond the pages listed above, or anything about you. SpotBack ignores clicks and typing in input fields, never reads form values, and does not run on Chrome pages, the Chrome Web Store or extension pages.
Sharing
SpotBack does not transmit, sell, share or use your data for anything other than restoring your position. There is no third party involved.
Permissions
storage: save the data above on your device.scripting: register and start the content script, only for websites you allow.activeTab: read the address of the current tab when you open the popup or press a shortcut.- Optional website access (
http://*/*,https://*/*): never requested silently. You approve it from a click, either for all websites ("Enable SpotBack everywhere") or only for selected sites. Chrome describes all-site access as "read and change all your data on all websites"; SpotBack uses it only to read the scroll position and the link you click, as listed above. You can remove access in Settings or in Chrome at any time, and exclude individual sites even while access is granted.
Your control
Retention, page-count limits, per-site clearing and "Clear all" are in SpotBack's Settings. Removing the extension deletes everything it stored.
Changes and contact
If this policy changes, the date above changes and the new version is published at this address. Questions: nicolasveithen000@gmail.com