DOMsters

▸ The short version

• From the sites you scan, only the domain travels (e.g. from opera.com/gx only opera.com) plus a few numeric DOM metrics.
• The path, the query parameters, the page content and anything you type never leave your browser.
• We do not read your history or your tabs — the extension doesn't request those permissions.
• We store your email (for the account) and your game progress in the cloud.
• Zero ad trackers, zero data selling, zero commercial profiling.
• Email us and your account and collection are deleted.

▸ Who is responsible

DOMsters is built by an independent solo developer (a natural person), who is the data controller for everything described here.

Contact: privacy@domsters.com

This policy covers the DOMsters browser extension (Chrome, Edge, Brave, Firefox) and the domsters.com services behind it.

▸ Exactly what data is processed

1. Account

Your email address and a password (never in plain text — the authentication provider stores a hash). If you sign in with Google, we receive the email and account identifier Google shares for that sign-in. Legal basis: performance of the service you asked for — no account, no cloud collection.

2. Game progress

Captured creatures, level, experience, coins, items, achievements, missions, arena trophies and settings, linked to your account ID. Legal basis: performance of the service (the game is cloud-first: your progress lives on the server, not only on your machine).

3. From the pages you scan

When you hit Scan, the extension analyses the DOM in your browser and sends the server only:

• The domain (hostname without www.). Never the full URL, the path or the parameters.
• The category inferred from the domain (social, news, video, shop, blog, forum, docs, gaming, hacker, misc).
• Numeric DOM metrics: element count, links, forms, tree depth, hidden elements and elements in an error state.
• A fingerprint (hash) derived from those metrics, so the same page always yields the same species.

No page text, images, HTML, form values or site cookies are sent. The server needs this to generate the creature deterministically and verifiably (so nobody can invent creatures or stats). Legal basis: performance of the service.

4. Game telemetry

Product events, so we know what works and what breaks: session start and end, scans, battles, captures, screen usage, and errors coming from DOMsters' own code (message, file and stack trace of the extension). They are tied to your account and the scanned domain, with a timestamp.

JavaScript errors thrown by the website you are visiting are explicitly discarded and never sent — their traces could contain third-party full URLs. Legal basis: legitimate interest in maintaining and debugging the service; you can switch telemetry off in the extension settings.

▸ What we do NOT do

• We do not read or store your browsing history (the extension declares neither history nor tabs).
• We do not capture keystrokes, form input, passwords or payment details.
• We do not inject ads or alter the content of the sites you visit (we only draw our own interface on top).
• There are no third-party trackers, ad pixels or commercial analytics SDKs.
• We do not sell, rent or share data with third parties for advertising, use it for commercial profiling, or train AI models with it.
• We will not transfer or sell data in a change of ownership without telling you first.

Data use is limited to operating and improving DOMsters, in line with the Chrome Web Store Limited Use policy.

▸ Why the extension asks for each permission

• Access to the sites you visit (<all_urls>): the browser is the game. The creature is born from the DOM of the page you're on, and the game UI is drawn over it. No page access, nothing to scan and nowhere to draw.
• storage: keep a local cache of your progress and preferences (language, sound) so the game starts instantly and survives a network drop.
• identity: sign in with Google through the browser's official OAuth flow. Used only when you press that button.
• notifications: tell you when your daily streak is about to break, and about in-game events. You can mute them.
• alarms: schedule that streak reminder in the background (no battery-draining live timers).

▸ Where the data lives and who processes it

• Supabase (PostgreSQL database, authentication, sprite storage): holds the account, progress and telemetry, acting as data processor. Data may be processed outside the European Economic Area under the standard contractual clauses in their data processing agreement.
• Google: only if you choose "Sign in with Google", and only to authenticate you.
• Hostinger: hosting for domsters.com and the download files.

On your machine, the extension keeps a game cache in the browser's local storage. Uninstalling wipes it.

▸ Retention and your rights

Retention: account and progress for as long as the account exists. Telemetry events for a maximum of 12 months. Deleting your account removes the account, the creatures and the progress.

Your rights (GDPR and equivalents elsewhere): access, rectification, erasure, portability, restriction and objection. To exercise them, write to privacy@domsters.com from your account address; we reply within 30 days at most. You may also complain to your data protection authority (in Spain, the AEPD).

Minors: DOMsters is not aimed at children under 14, and we don't knowingly collect their data.

▸ Beta note

DOMsters is in beta. Bugs happen, and progress could be reset during this phase — you'd be told if that were to happen. The extension ships unobfuscated: you can read exactly what it does and what it sends, and check it in your browser's network tab.

If this policy changes materially, the date in the header is updated and you'll be notified inside the extension.