Reject & Verify: privacy policy
Agent Harbor LLC, Bremerton, Washington, USA. Contact: support@agentharbor.agency. Last updated: 27 October 2026. Plain language, not legal advice.
Short version: everything Reject & Verify does happens on your device. We do not collect, receive, store, sell or share anything about you or your browsing. There is no account, no analytics and no telemetry.
What the extension does with the pages you visit
- On each web page it looks for a cookie banner and clicks the "reject" control. It reads the page's own elements to do that.
- It adds the Global Privacy Control signal (
Sec-GPC: 1) to your requests (Chrome and Edge; Firefox sends it itself only when you turn it on in its settings, and this extension does not set it there). - It watches the addresses of requests your browser makes while a page loads (it does not read their content, headers or cookies' values) and compares each address with a list of well-known tracker hosts that is bundled inside the extension. It also reads the names (never the values) of cookies that the page's own scripts can see, to compare them with a list of well-known tracker cookie names. This is how it shows "trackers still fired after the reject".
- The result for each open tab is kept in your browser's memory and in
storage.session, which the browser clears when it closes. The extension keeps no browsing history. The only list of sites it stores is the one you create yourself by pausing sites, and it stays on your device (see below).
What we keep on your device
Your settings: on/off, the sites you paused, and whether you allowed reports (off by default). They live in the browser's extension storage and are removed when you uninstall.
What leaves your device
Nothing. The extension has no server, no analytics, no crash reporting and loads no remote code or remote lists. The "Own this site? Monitor it with ConsentProof" link, shown only when trackers still fired, is an ordinary link: it opens agentharbor.agency in a new tab only if you click it, and the link contains no site name or browsing data (only a fixed campaign tag, utm_source=reject-verify). Agent Harbor's website may count visits to that page like any website does; see the website's privacy policy.
Optional report (off by default; not available in the first release)
The popup contains a "Report a banner we couldn't reject" feature. In this release it is disabled because no destination is configured, so nothing can be sent. If a future version enables it, it will stay off until you switch it on, show you exactly what would be sent for each report, and send it only after you confirm: the site's hostname and the name of the consent platform, and nothing else (no page address, no cookies, no tracker list, no identifier, no time). We would update this policy and the store disclosures before that version is published.
What the results mean
The extension reports what it saw on one visit ("Rejected · 3 trackers still fired"). It does not know about trackers that are not in its small bundled list (they are shown as "unclassified", which is not the same as clean), it cannot see HttpOnly or third-party cookies, and a clean result is not a finding about whether a site follows any law. It is not legal advice.
Permissions
Each permission and why it is needed is in the store listing and in PERMISSIONS.md. The all-sites access exists so the extension can work on any site you visit; the extension does not send any of it anywhere.
Children
The extension is a general-purpose tool and does not knowingly collect data from anyone, including children.
Changes and contact
If this policy changes, the new version is published on this page with its date, and any change that would send data off your device would also be shown in the extension before it takes effect. Questions: support@agentharbor.agency.
AI assistance disclosure: this extension's code and this text were written with AI assistance. The extension itself uses no AI and contacts no AI service.
Technical evidence of observed behavior on the date tested. Not legal advice and not a certification of compliance.