Privacy Policy

Local-first by design

Chase Now is a Chrome extension that does two things while you are standing at a checkout page: it tries candidate coupon codes one at a time and keeps the one that produced the lowest real order total, and it ranks the cards you told it about so you can see which one pays the most on that specific purchase. Both of those jobs happen entirely inside the browser tab you are already looking at.

That architecture is the whole privacy story. There is no Chase Now account, no sign-in, no sync service and no analytics inside the extension. We operate no server that receives your cart contents, your line items, your order totals, the merchants you shop with, the codes that worked for you, or the cards in your wallet. We could not produce that data in response to a subpoena, because we never hold it.

Two things are separate from the extension and are covered further down: our marketing website at chasenowsavings.com, which sets one first-party cookie to remember your answer to its cookie banner, and the Chrome Web Store listing, where Google gives us aggregate install and rating numbers that we cannot tie back to an individual.

This policy is published by Chase Now Labs, Inc. and covers the Chase Now extension, the chasenowsavings.com website and email you send to our published addresses. Questions about any of it go to [email protected].

What the extension stores on your device

Everything the extension remembers is written through the Chrome chrome.storage API, which lives in your browser profile on your computer. Five keys are kept in chrome.storage.local and survive a browser restart:

Four further keys are written to chrome.storage.session, which the browser discards when the browser session ends:

• cn.run.active — the state of a chase that is currently in progress, per tab, so a cart that reloads between codes costs one step rather than the whole run.
• cn.frames — per tab, which frame reported a coupon field or an order total, so the popup and the chase talk to the right frame of the page.
• cn.autorun — a note of where an automatic chase has already been started, so the same cart is not chased twice.
• cn.catalog:<url> — the response from the optional catalog URL described below, cached for six hours.

Card records deliberately hold no card number, no expiry date and no CVV. The form has fields for a card, a nickname and the last four digits and nowhere to put anything else. Chase Now never asks for a billing address, a bank login or a one-time passcode, it does not read your browser’s autofill vault, and it does not fill payment fields.

One setting can cause an outbound request: Extra code catalog URL, which is empty and therefore off by default. If you paste a URL into it, your browser fetches that URL directly to look for additional codes for the store you are on, exactly as if you had typed the address into the address bar, and the response is cached for six hours in session storage under cn.catalog:<url>. The request is sent without credentials, and it goes to whoever operates that URL, not to us; we do not see it or log it. Because the extension holds no blanket host access, the fetch only succeeds for a URL whose server sends permissive CORS headers; anything else fails, is logged to your own browser console and is otherwise ignored. Leave the field blank and the extension only ever uses the code and reward data bundled inside the downloaded package.

What the website collects

chasenowsavings.com is an ordinary marketing site and behaves like one. Our host records standard server logs (IP address, user agent, requested URL, timestamp, response status) which are kept for 30 days and used to diagnose outages and block abuse.

We run no analytics or measurement product on this site. There is no Google Analytics property, no tag manager, no advertising pixel and no third-party measurement script: the page loads nothing but our own HTML, CSS, self-hosted fonts, images and one small script. The only cookie the site sets is the one that records your answer to its cookie notice, and the full inventory is in our Cookie Policy.

If you email us, we receive the address you write from, your message and any attachments. We keep support correspondence for 24 months so we can recognise a follow-up on the same issue, then delete it. We do not add you to a mailing list because you asked a support question.

Google operates the Chrome Web Store listing and gives us an aggregate dashboard: install and uninstall counts, weekly active users by country, star ratings and the text of public reviews. Those figures arrive already aggregated and we cannot connect them to a person. Reviews are public because you chose to publish them; Google’s own privacy terms govern that account.

Permissions, and why each one is needed

Chrome shows you a permission prompt before installing. Chase Now asks for the smallest set that makes the product work, and nothing that would let us collect data centrally. Four permissions are requested at install time; access to a store is separate, optional, and granted by you one store at a time.

• storage — writes the keys described above into your own browser profile. This is the permission that lets your wallet and code history survive a browser restart. It grants no network access.
• alarms — runs a watchdog timer that picks a chase back up if a step is lost, which happens when the cart navigates and Chrome shuts the extension’s background worker down in the middle of a run. Without it a stalled run would sit there with a dead progress panel.
• scripting — registers the content script for the stores you have enabled, and injects it into the tab you are already looking at the moment you enable one, so you do not have to reload the page. The registration is rebuilt from your permission list every time that list changes, so a store you revoke loses the script.
• activeTab — lets the extension see which page the tab you are looking at is on when you click the toolbar icon, so the popup can name the store, tell you whether you have enabled it, and offer to enable it. It gives no access to a page you have not clicked the icon on, and it is not used to build a browsing history: no list of URLs you visited is ever stored.
• Optional host access, one store at a time — not requested at install. The extension ships with no host access at all, and asks for a store only when you press Enable on this store in the popup. That is what lets the content script find the promo-code field, type a candidate, submit it and read the recalculated order total — which is the only trustworthy measure of a discount. The next section explains exactly what the grant covers.

Chase Now does not request webRequest, cookies, history, bookmarks, downloads, clipboardRead, identity or geolocation, and it declares no remote code. It also declares no static content scripts, so before you enable a store there is no Chase Now code running on any page you visit. Under Manifest V3 every line of logic it runs shipped inside the reviewed package, so nothing new can be pushed into it between updates.

What enabling a store actually grants

Host access is the one permission that lets Chase Now see a page, so it is worth being exact about it. The grant happens at a single moment: you open a store, click the Chase Now icon and press Enable on this store. Chrome then shows its own permission dialog, and nothing is granted unless you accept it.

What you grant is the pattern *://*.<domain>/* for that merchant — for example *://*.nike.com/*. That covers the whole domain, including its subdomains, over both http and https, not only the cart page you were standing on. It is a store-wide grant because a checkout commonly moves between www, shop and checkout hosts mid-purchase, and a grant that expired at the first redirect would break in the middle of a run.

The grant persists until you revoke it. It does not lapse when the run ends, when you close the tab or when you restart the browser. You can take it back at any time from Stores you enabled on the options page, where each store has a × that revokes it, or from Chrome’s own chrome://extensions page. Revoking immediately unregisters the content script for that store. Uninstalling the extension removes every grant.

While a store is enabled, the content script runs on every page of that store, in all frames, once the page has settled (document_idle), and it stays registered across browser restarts. On each page it watches the document with a MutationObserver so it notices the cart total changing, and it reports a small summary to the extension’s own background worker: the page URL, whether a coupon field or an order total was found, the total itself, and any codes seen on the page. That summary is what the popup shows you; it is not sent anywhere off your device.

One part of this deserves naming plainly. On pages that look like a cart or a checkout — a coupon field is present, or the URL looks like a cart and a total was found, or there is a visible pay-style button and a total — the content script also reads the visible text of the page, up to 200,000 characters of document.body.innerText, at most once every ten seconds, to pick up codes the store is advertising to you in a banner or a “use code” badge. Those codes go into the candidate list for the chase. The page text itself is discarded as soon as it has been scanned: what is written down is the codes, not the text. On a page that does not look like a cart, the full-text scan does not run at all.

The data produced by an enabled store lands in cn.codes and cn.runs on your device, plus the session keys cn.frames, cn.autorun and cn.run.active described above, which the browser discards when your browser session ends. No part of it is transmitted to us, because there is nowhere for it to be transmitted to.

Legal bases and your rights in the EEA and UK

For the small amount of personal data we do process (website server logs and support email) Chase Now Labs, Inc. is the controller and relies on these legal bases under the GDPR and UK GDPR:

• Legitimate interests (Article 6(1)(f)) for server logs, security monitoring and answering a support message you initiated. Our interest is keeping the site online and responding to you; the impact on you is minimal and you can object at any time.
• Consent (Article 6(1)(a)) for any non-essential cookie. We do not currently set one, so there is nothing here to consent to; if that changes, the banner will ask before the cookie is set, and you can revisit the answer from the Cookie settings link in the site footer without losing access to anything.
• Contract (Article 6(1)(b)) where you have specifically asked us to do something, such as sending a reply to a question about the extension.

You have the right to request access to the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent. Because the extension holds no data on our side, a request will in practice cover website logs and email threads. Write to [email protected] and we will answer within 30 days; we may ask you to confirm the email address the request relates to, but we will not demand identity documents.

Data you hold in the extension is under your direct control, which is the fastest possible route to erasure: use Export everything to obtain a portable JSON copy, and uninstall or use Erase all data to delete it. You may also lodge a complaint with your supervisory authority: the Information Commissioner’s Office in the UK, or your national authority in the EEA.

California privacy notice (CCPA/CPRA)

We do not sell or share personal information, and we have not done so in the preceding twelve months. “Share” here carries its CPRA meaning of disclosure for cross-context behavioural advertising. We run no ad pixels, no ad-network tags and no data brokers, on the website or in the extension, so there is nothing for us to offer an opt-out from: though we honour the Global Privacy Control signal anyway, as described in the Cookie Policy.

In the last twelve months the categories we collected were limited to identifiers (IP address, and your email address if you wrote to us) and internet or network activity (pages requested on chasenowsavings.com). We collected them from you directly or automatically through the site, for the business purposes of operating and securing the website, measuring traffic in aggregate, and providing support. We do not collect sensitive personal information, and we do not use personal information for profiling or automated decision-making with legal effects.

California residents may request to know the categories and specific pieces of personal information we hold, to delete it, to correct it, and to limit the use of sensitive personal information. Email [email protected] with the subject line “California request”. We verify a request by replying to the address on file and asking you to confirm; an authorised agent must supply written permission. We will not deny service, charge different prices or degrade quality because you exercised a privacy right.

Retention and deletion

Extension data has no expiry we impose on you: it stays in chrome.storage until you remove it. Three practical routes exist. Uninstalling Chase Now makes Chrome discard the extension’s storage area, which deletes your wallet, offers, code history, settings and run log together, and drops every per-store permission with it. Erase all data on the options page clears the same stored data while keeping the extension installed — it asks you to confirm first, and it does not revoke the stores you enabled; those are revoked one at a time from the Stores you enabled list, or from chrome://extensions. Individual items (a card, an offer, a single saved code) can be deleted one at a time from their own rows.

Use Export everything before you uninstall if you want to keep anything. The export is a plain, readable JSON file written to your normal downloads folder, containing your wallet, offers, code library, settings and run log. Import backup restores it on a new machine, with one deliberate gap: it brings back the wallet, the offers, the code library and the settings, but not the run log, which stays local to the machine the chases happened on. The file never passes through us, so treat it like any other document that names your cards and keep it somewhere you trust.

On our side the retention schedule is short and fixed: server logs 30 days, support correspondence 24 months, and records we must keep for tax or legal reasons for as long as the applicable law requires. Nothing else is retained, because nothing else is collected.

Children under 16

Chase Now is built for adults who hold their own payment cards. It is not directed at children, we do not knowingly collect personal information from anyone under 16, and the product has no social features, messaging, profile or content feed of any kind.

If you believe a child has used the extension on a shared computer, the remedy is entirely local: uninstalling it, or using Erase all data, erases the stored wallet and history immediately. If you think a child has sent us personal information by email, write to [email protected] and we will delete the message and any reply thread.

International transfers

Chase Now Labs, Inc. is based in San Francisco, California. Our website hosting and email run on servers in the United States, so the limited website data described above is processed there. Extension data is never transferred anywhere, because it never leaves the device you installed it on.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum, and we carry out a transfer risk assessment for each processor. Our processors are contractually bound to process data only on our instructions, to keep it confidential and to delete it on termination. A current list of processors, and copies of the relevant clauses, are available on request from [email protected].

Changes to this policy, and how to reach us

When this policy changes we update the date at the top of the page and keep the previous version available on request. If a change is material (a new category of data, a new purpose, a new recipient) we will say so in the extension’s release notes and on the site before it takes effect, so that continuing to use Chase Now is a choice you make with the facts in front of you. We will never make a change that starts sending your cart, totals or wallet to a server without an explicit, separate opt-in.

Privacy questions, data requests and complaints:

• Email: [email protected] (general enquiries: [email protected])
• Post: Chase Now Labs, Inc., 2261 Market St #4718, San Francisco, CA 94114, United States
• Web: chasenowsavings.com

We read every message from a human, usually within five business days.

Questions about this document? Write to Chase Now Labs, Inc., 2261 Market St #4718, San Francisco, CA 94114 or email [email protected].

Related: Terms of Service · Cookie Policy · Accessibility Statement