Privacy policy — Slop Blocker
Last updated: 2026-09-03
Published at https://slopblocker.nnnada.com/privacy/, and generated from this file, so the two cannot disagree.
The short version
Slop Blocker does all of its work on your own computer. It has no server, no account, no analytics and no telemetry. Nothing about the pages you visit is ever transmitted to us or to anyone else, because there is nowhere for it to be transmitted to.
What the extension stores, and where
Everything is stored locally in the browser's extension storage. None of it syncs anywhere.
Persisted on your device (chrome.storage.local)
- Your settings: whether protection is on, the blocking threshold, auto-pause, tracker mode, and the list of sites you switched it off on.
- Your lists: authors you blocked or trusted, and sites you blocked.
- Counters: how many items were blocked all-time, broken down by media type, and how many tracker requests were seen. These are plain numbers — no URLs, titles or timestamps are kept.
Kept only until the browser closes (chrome.storage.session)
- What was detected on each open tab, so the popup and the badge can show it. This includes the page URL and the media URL of each detection, and is deleted when the tab closes or the browser exits.
- A cache of which media URLs were already checked for provenance metadata, so the same file is not read twice.
You can clear all of it at any time: Reset statistics in the options page for the counters, the list editors for your lists, or removing the extension for everything.
Network requests
The extension makes exactly one kind of network request: it reads media that the page you are viewing already loaded, in order to look at that file's metadata (C2PA Content Credentials and IPTC/XMP fields) and decide whether the file declares that it was generated by AI.
These reads:
- go only to the site serving the image or video you are already looking at;
- send
credentials: "omit", so no cookies or authentication of yours are attached; - normally ask for only the first 256 KB of a file, because that is where the metadata lives;
- are limited to media near your viewport, and are cached so a file is read once.
The extension sends no requests to any domain of ours, and no third-party services are contacted. Remote list updates are not implemented; the corresponding setting is forced off in code.
What the extension does not do
- It does not read or transmit your browsing history.
- It does not read form fields, passwords, cookies or page text beyond the captions and titles next to a media item, which are examined in memory and never stored or sent.
- It does not inject anything into pages other than its own warning overlay.
- It contains no advertising, no affiliate links and no tracking of its own.
Permissions, and why each is needed
| Permission | Why |
|---|---|
storage | Save your settings, lists and counters, as described above. |
tabs | Know which tab the popup is showing, and clear a tab's detections when it navigates or closes. It is not used to read a history of your browsing. |
contextMenus | Provide the right-click "block this author" / "trust this author" actions. |
declarativeNetRequest | Block tracker requests — only when you turn blocking on. The browser enforces the rules; the extension never sees the requests. |
Access to all sites (<all_urls>) | AI content can appear anywhere, so the detector has to be able to run anywhere, and metadata reads are cross-origin by nature. You can switch the extension off per site or globally at any time. |
The declarativeNetRequestFeedback permission is deliberately not requested, even though it would let the extension count blocked tracker requests: it carries a "read your browsing history" warning, and a more accurate counter is not worth that access.
Children
The extension collects no personal data from anyone, of any age.
Changes
If this policy ever changes, the change will be in the repository's history alongside the code change that caused it.
Contact
Open an issue at https://github.com/ddtch/slop-blocker/issues. For anything security-sensitive, report it privately instead — see SECURITY.md.
The source is at https://github.com/ddtch/slop-blocker under the MIT licence, and each release publishes the SHA-256 of a reproducible build so you can check that the package in the store is the code in the repository. Every claim on this page is meant to be verifiable that way rather than taken on trust.