Privacy Policy

01Who runs WhatTheCSS

WhatTheCSS is operated as a sole proprietorship by Sandipan Mukherjee, registered for GST in West Bengal, India. The following are our business details for the purposes of this policy and for any legal correspondence:

For any privacy question — access requests, deletion requests, complaints, or general queries — email support@whatthecss.dev. You will get a reply from a human, usually within a few working days.

02What the extension does and doesn’t do

WhatTheCSS is a Chrome extension (Manifest V3) with a deliberately minimal permission set. When you hover an element to see its CSS, all of that work happens locally in the page’s JavaScript context. Nothing is sent off your machine. When you copy CSS to your clipboard, the clipboard write happens through Chrome’s API; we never see what you copied.

The extension does not read or transmit:

• the URLs of pages you visit;
• the contents of pages you visit;
• the CSS you inspect or copy;
• your IP address, cookies, browsing history, or login state on any site;
• anything you type, in any field, on any page.

The extension has no analytics, no telemetry, no error reporting, and no usage counters. By design, adding any of these would require a Chrome permission change — which Chrome would surface to you as a re-prompt on update.

03Chrome permissions, explained

Below is every permission WhatTheCSS requests, what it enables, and — just as importantly — what it does not enable.

We do not request: host permissions of any kind (no <all_urls>, no per-site access lists), tabs, webRequest, cookies, history, bookmarks, downloads, identity, management, or any permission that would let us watch your browsing. Because there are no host permissions, Chrome shows no “read data on websites” warning at install — there is nothing to warn about.

04Settings stored on your device

All extension state is stored locally on your machine using Chrome’s chrome.storage APIs. None of it is transmitted to us except for the license operations described in sections 05 and 06. The full inventory:

• License key — stored in chrome.storage.sync so it follows you across the Chrome profiles you are signed into. Sync is handled by Google; we have no access to it.
• License envelope — a small cached object ({ key, instanceId, deviceName, pro, lastChecked }) stored in chrome.storage.local so the extension can answer “are you Pro?” instantly, without a network round-trip on every keystroke.
• Install identifier — a 16-character random ID generated the first time you activate Pro, stored in chrome.storage.local. It is sent to our licensing backend so you can recognise the device in your management UI. It is not a tracking cookie, not a browser fingerprint, and not tied to your IP address or hardware.
• UI preferences (color format, copy mode, toolbar position, tooltip position, the personal component library if you use it, and similar) — spread across sync, local, and session depending on whether they should follow you across machines, stay on this machine, or clear when you close the browser. All local-only.

To wipe everything the extension has stored, uninstall it from chrome://extensions. Chrome clears all extension storage on uninstall.

05When you buy a Pro license

If you choose to upgrade to Pro ($29, $19 early bird, one-time), we redirect you to Dodo Payments, the licensed merchant of record that handles the checkout. Dodo collects and processes your card details, billing address, and tax information; we never see any of it. Dodo also handles tax collection, invoicing, and remittance in the relevant jurisdictions.

From Dodo, we receive: your email address, the fact that you purchased a Pro license, the amount and currency, and a Dodo transaction ID. We use this to issue your license key and to honour refunds.

Third parties involved in a purchase

The purchase record itself is held by Dodo. We do not maintain a separate customer database. Any device-activation state we temporarily hold is described in the next section.

06License validation, once a day

If you have activated a Pro license, the extension validates that license at most once every 24 hours by calling our license endpoint at whatthecss.dev/api/license/validate. That endpoint is a Cloudflare Worker we operate. The Worker is a thin proxy to Dodo Payments — Dodo is the actual source of truth for whether a license is valid and how many devices it is activated on.

The validation request contains:

• your license key;
• the instance ID assigned to this device by Dodo at activation;

The Worker forwards this to Dodo over an authenticated HTTPS connection and returns Dodo’s response. The Worker keeps no persistent application logs of validation requests: it does not log the license key, the instance ID, your IP address, your email, or any usage data. Cloudflare's edge logs are retained per Cloudflare's own retention policy; see their privacy policy for current details.

We use these validation calls for exactly two purposes:

1. Seat enforcement. Each Pro license permits activation on one device. Dodo counts distinct activations and refuses a second until you deactivate the current one on your license dashboard.
2. The “last seen” timestamp shown on your license dashboard, so you can tell which devices are still in use and remove ones you no longer have. Devices that do not validate for 30 consecutive days are automatically deactivated to free their slot.

If Dodo’s API exposes per-device “last validated at” timestamps directly, the Worker proxies them and stores nothing of its own. If Dodo does not expose that field, the Worker maintains a small Cloudflare KV table whose entire schema is: instance ID, license ID, friendly device name (as you typed it at activation), OS class (“macOS” / “Windows” / “Linux” / “Other”), activation timestamp, and last-validated timestamp. That is the whole row. There is no IP address, no email, no inspection content, no browser fingerprint, no analytics. Rows are deleted when the device is deactivated, and rolled off automatically after 30 days of inactivity by the same cleanup that frees idle slots.

The validation call does not tell us:

• which pages you have visited;
• what CSS you have inspected or copied;
• how often you have used the extension between check-ins;
• your name, location, or any contact detail beyond what is already in your Dodo customer record.

The Pro state cached in chrome.storage.local stays valid for up to 30 days even if validation requests fail (for example, while you are offline). This means a temporary outage of our infrastructure cannot lock you out of features you have paid for.

07When you email us

The single contact address for everything — license help, refund requests, privacy questions, deletion requests, bug reports, anything — is support@whatthecss.dev. Messages land in our inbox and stay there until we delete them or you ask us to. We use the email address only to reply. We do not add you to any mailing list; there is no mailing list.

08Cookies, analytics, tracking

The marketing site at whatthecss.dev runs no analytics of its own and no tracking pixels: no Google Analytics, no Plausible, no Fathom, no Meta Pixel. It does load one third-party script, a live-chat widget provided by Kicolo, so you can message us from any page. When the widget loads, and when you use the chat, Kicolo may set its own cookies and receives limited data such as your IP address, the page you are viewing, and any messages you send, all under Kicolo’s own privacy policy. Aside from the chat widget, the site sets no tracking cookies. The license dashboard may set a short-lived, strictly-necessary cookie if a session is required to keep you signed into your own license: such cookies do nothing besides authenticating you to your own license record, and are cleared as soon as the session ends.

When you visit whatthecss.dev, your browser makes a request to Cloudflare’s network. Cloudflare records standard request metadata (your IP address, user-agent, requested URL, timestamp) in its edge logs for up to 30 days, for security and abuse prevention. We do not export these logs, do not connect them to any other dataset, and do not use them for analytics.

The extension itself fires no analytics events. It has no ability to. The code is structured so that adding analytics would require a manifest permission change, which Chrome would surface to every user on update.

For completeness: we do not run any fingerprinting of your browser, device, network, or behaviour. We do not perform A/B testing or personalisation. We do not use, or feed user data into, any AI training pipeline.

09Your rights

Depending on where you live, you have legal rights over the personal data we hold about you. These rights are recognised under the General Data Protection Regulation (EU GDPR), the UK GDPR, India’s Digital Personal Data Protection Act 2023 (DPDP), the California Consumer Privacy Act (CCPA / CPRA), and a number of similar laws.

Regardless of jurisdiction, we will honour the following requests:

• Access. Ask us what personal data we hold tied to your email or license key. We’ll send you a copy within 30 days.
• Correction. Ask us to fix anything inaccurate — for example, the email address linked to a license.
• Deletion (“right to be forgotten”). Ask us to delete your purchase record. We will comply, except for the minimum information we are required to retain for tax or accounting purposes under Indian law (see section 10).
• Portability. Ask us to export your data in a machine-readable format (JSON or CSV).
• Objection / restriction. Ask us to stop processing your data for any specific purpose. In practice we only process it for the purposes described on this page, but we’ll honour the request.
• Withdrawal of consent. Where processing relies on your consent, you can withdraw it at any time.
• Complaint. You have the right to lodge a complaint with your local data protection authority — for example, the ICO in the UK, your national DPA in the EU, or the Data Protection Board of India. We would much rather you contact us first so we can put it right.

The simplest way to exercise any of these rights is to email support@whatthecss.dev from the address associated with your purchase. We will not charge you for these requests, and we will not ask for any identification beyond confirming the email address on file.

Legal bases (for EU / UK users)

Under GDPR and UK GDPR we are required to identify a lawful basis for each kind of processing. Ours are:

• Performance of a contract — processing your email, license key, and device activations to deliver the Pro product you bought.
• Legitimate interest — brief retention of edge logs and validation records for abuse prevention and seat enforcement, balanced against your privacy interests (we minimise and time-limit both).
• Legal obligation — retaining the minimum transaction records required by Indian tax law.

We do not rely on consent for any of these activities, which is why you are not asked for cookie consent and why you are not on any mailing list.

For California users (CCPA / CPRA)

We do not sell personal information, and we do not “share” it for cross-context behavioural advertising (the technical CPRA definition). California residents have the same access, deletion, correction, and portability rights described above; exercise them by emailing support@whatthecss.dev.

10How long we keep what

The full list of what is kept and for how long:

• Your purchase record (email, name, billing country, license key, transaction ID, receipts and invoices) is held by Dodo Payments as merchant of record, not by us. Dodo retains it for as long as required under their own data deletion policy and applicable financial regulations. When you ask us to delete your data, we delete our side immediately; we will also forward your request to Dodo where their policy and the law permit deletion, but we cannot delete records they are legally required to retain.
• Device activations (instance ID, friendly device name, OS class, activation timestamp, last-validated timestamp): held by Dodo as the source of truth, and temporarily mirrored in our Cloudflare KV table only when Dodo’s API does not surface the timestamps directly. Rows are deleted on deactivation. You can also remove any device yourself at any time on your license dashboard.
• Support emails: kept for up to 1 year from our last reply, or until you ask us to delete them.
• Cloudflare edge logs: up to 30 days under Cloudflare’s defaults. We do not export or process these.
• Uninstall survey answers: 180 days, then deleted automatically. See section 7a.

07aIf you uninstall

When you remove the extension, Chrome opens a page on our site asking one question: why. Answering is entirely optional, and nothing is sent unless you pick an answer and press the button.

If you do answer, we store only the reason you picked, the optional free-text note if you wrote one, the date, and roughly how long the extension had been installed. That last one is a coarse band, never an exact duration: “under a day”, “1 to 7 days”, “1 to 4 weeks”, “1 to 3 months”, or “over 3 months”. It tells us whether something failed immediately or wore thin over time, which is the difference between two very different problems. Alongside it we record whether you were on the free or Pro tier, and which version of the extension you were running, so we can tell whether a spike follows a particular release.

To be precise about how those three reach us: the extension attaches them to the page address, so they are part of the request your browser makes when the page opens, and they appear in the standard Cloudflare edge logs described in section 8 for up to 30 days. They are only written into a feedback record, and only emailed to us, if you actually submit the form. None of the three is tied to your identity, and none can be matched against your purchase record: the feedback holds no license key and no email address. We do not store your IP address, your email, your browser, or your license key, and there is nothing in the record that ties it back to you. Your IP is used at that moment only to rate-limit the form against abuse, in a counter that expires and is never written into the answer.

A copy of each answer is emailed to our own support address so we actually read it. That email contains the same three fields and nothing more: it has no reply address, because there is nothing to reply to.

Answers are deleted automatically after 180 days. Because they are anonymous, we cannot find or delete an individual answer on request: there is nothing linking any answer to any person.

11International transfers

WhatTheCSS is operated from India. Some of our third-party processors are based outside India or operate global infrastructure: Dodo Payments (US), Resend (US), and Cloudflare (global). When personal data is transferred internationally, we rely on the processor’s own legal mechanisms (such as Standard Contractual Clauses for EEA / UK transfers) to provide a level of protection equivalent to your local law. The Kicolo live-chat widget on the marketing site (see section 8) is an additional processor of this kind.

12Children

WhatTheCSS is a developer tool. It is not directed at children, it is not designed for use by children, and we do not knowingly collect personal data from anyone under 13 (or under 16 in the EU / UK where the local age applies). If you believe a child has provided personal information to us, email support@whatthecss.dev and we will delete it.

13Changes to this policy

If we change this policy, we will update the “Last updated” date at the top of the page and increment the version number. Material changes (anything that affects what data we collect or how we use it) will be announced in the changelog and, where the law requires it, notified to existing customers by email. We do not retroactively change how data already collected is used.

14Contact

For privacy questions, deletion or access requests, security disclosures, or anything else relating to this policy:

Email: support@whatthecss.dev
Post: Sandipan Mukherjee, BL-21, 7-FR, FL-7C, E3-398 Joth Sibrampur LP-4/99/7/15, Shibrampur Road, Kolkata, South Twenty Four Parganas, West Bengal 700141, India

The Terms of Service cover what we promise about the product, refunds, and how the license works. Read those alongside this policy.