Privacy Policy

What Krawlify is

Krawlify is a Chrome extension that connects your browser to a relay server, so your own automation software can drive tabs that Krawlify opens, using the Chrome DevTools Protocol.

The relay is open-source software. You choose which one Krawlify talks to, and it is the only destination any data reaches:

• https://alpha.krawlify.com is the relay Krawlify ships pointed at, operated by us. Data your automation reads passes through it in order to reach your automation. It is a switchboard: it holds no browser state of its own and stores no crawled content. It is in alpha and carries no uptime commitment.
• Any relay you host yourself. Change the Server URL on the options page and nothing reaches us at all.

There is no account and no sign-up in either case. Your browser identifies itself with a token it generates locally, not with credentials you supply.

What Krawlify handles, and where it goes

When you connect Krawlify to a relay and your automation opens a tab through it, the following is transmitted to the relay you configured — because that is what driving a browser remotely consists of:

• Website content of tabs the automation opened: page HTML and text, the DOM, screenshots, and network requests and responses belonging to those tabs.
• Page addresses and titles of tabs the automation opened, so your client can identify and address them.
• Activity within those tabs, such as network events and the results of commands your client issues.
• Cookies, only if you explicitly grant the optional cookies permission on the options page. When granted, your automation can request cookies for a domain through the extension. This permission is off by default and can be revoked at any time.
• A token, generated randomly in this browser, sent to your relay to identify this browser's connection.

All of it goes to the relay address you entered, and nowhere else.

What Krawlify never handles

• Tabs you opened yourself. Their addresses, titles and contents are never read and never transmitted. They are not merely filtered out of a list — the protocol has no way to address them. A tab becomes visible to your automation only by being created by that automation, and stops being visible when it closes.
• Your browsing history, bookmarks, downloads or saved passwords. Krawlify does not request the permissions needed to read them.
• Analytics of any kind. There is no telemetry, no crash reporting, no usage tracking and no third-party service in the extension. The only network connection it makes is to the relay address in its settings.

What is stored on your device

Krawlify stores three values in chrome.storage.local:

1. the relay server URL you entered,
2. the random token this browser generated for itself,
3. whether you last pressed Connect or Disconnect.

Nothing is written to chrome.storage.sync. Uninstalling the extension removes all of it.

The app, the relay and the agent skill

The three non-browser components are software you run on your own infrastructure. We do not operate them, cannot see them, and receive nothing from them.

• The Krawlify app stores your account, your crawls and their results in a PostgreSQL database you provision, and queues work in a Redis instance you provision. Crawled page data stays there. Any webhook you configure sends crawl-completion events to a URL you choose.
• The relay holds no browser state and writes no crawled page content to disk. Tab ownership is in memory and discarded when the connection ends.
• The Krawlify Agent skill runs on your machine and writes its Excel report to your working directory. Its .env.local holds your relay URL and token; treat that file as a credential.

What those components do with crawled data is determined by you, as is the retention of anything they write.

The public demo

app.krawlify.com is a shared demonstration instance whose sign-in details are published on this website. Everyone who uses it shares one administrator account.

Treat everything you put into it as public. Crawls you start, the URLs you enter, the results they produce, any API key you create and any webhook or proxy address you configure are visible to every other visitor, and can be changed or deleted by them. Do not enter confidential information, personal data, real credentials, or a token from your own browser extension.

The instance is reset without notice. Nothing in it is backed up, and nothing in it is recoverable once it is gone. Crawls started there run from our infrastructure, so the target site sees our address rather than yours, and ordinary server logs record the activity.

None of this applies to an instance you run yourself, which is the intended way to use Krawlify — see the section above.

This website

krawlify.com is a static site. It sets no cookies, runs no analytics, embeds no third-party scripts, fonts, images or frames, and makes no network request to any host other than itself. There are no forms and no sign-up, so there is nothing here for you to submit.

One value is stored in your browser's localStorage under the key krawlify-theme: whether you chose the light, dark or system colour scheme. It never leaves your browser and is not a cookie. Clearing site data removes it.

The web server keeps ordinary access logs — IP address, timestamp, requested path, referrer and user agent — for operating the service and diagnosing faults. They are not used to build a profile of you and are not shared.

Retention

The extension retains nothing beyond the three settings above. Tabs opened by your automation are closed, and their debugger sessions detached, when the crawl ends or the connection is lost.

On alpha.krawlify.com, the relay is a switchboard between your browser and your automation. It holds no browser state of its own, writes no crawled page content to disk, and keeps nothing after your browser disconnects: tab ownership is in memory and is discarded when the connection ends. Operational logs record connection events — timestamps, and the token identifying a connection — not page content.

On a relay you host, retention is entirely yours to determine, as is what the software you connect to it does with the results.

Sharing with third parties

Your data is not sold, rented or transferred to any third party, and is not used for advertising, profiling or any purpose other than carrying out the automation you asked for.

Data passing through alpha.krawlify.com reaches us only in transit, because relaying it is the function you are using. If you would rather it did not reach us at all, change the Server URL to a relay you host — the extension works identically, and the software to run one is open source.

Security

Your token is both identity and credential: anything holding it can drive your browser.

• Use an https:// relay address for any relay not on your own machine, so the token and the crawl traffic are encrypted in transit.
• Renew Token on the options page issues a new token and immediately cuts off anything still using the old one.
• Disconnecting closes every tab the automation opened.

To report a vulnerability, see the security page.

Your controls

• Disconnect in the popup ends the session and closes the automation's tabs.
• Renew Token revokes access for anything holding the previous token.
• The cookies checkbox on the options page grants and revokes cookie access.
• Change the Server URL to a relay you host, and no data reaches us.
• Uninstalling removes the extension and everything it stored.

Children

Krawlify is a developer tool and is not directed at children.

Changes

Material changes will be reflected here with an updated date above.

Contact

Krawlify.com — https://krawlify.com — [email protected]