Privacy Policy
Last updated: 20 August 2026
Applies to: the NovaBlock browser extension (Chrome, Edge and other Chromium browsers; Firefox and Firefox for Android) and the website at novablock.app.
1. Summary
NovaBlock blocks ads, trackers, pop-unders, cookie banners, cryptominers and malware domains. All filtering happens on your device. NovaBlock does not record the pages you visit, does not read page content or form input, does not sell or share data with advertisers, and contains no advertising SDKs.
NovaBlock does process personal data in three situations, all of which are optional and under your control:
- Premium licensing — a random per-install identifier, and your licence key if you have one, are sent to our server to confirm entitlement.
- An account — if you choose to create one, we process your email address, name and password, and your billing details are processed by Stripe.
- Optional diagnostics — crash reporting and website analytics, both off by default.
Sections 3 to 6 below set out, in order and without omission, what is collected, how it is processed, where and how long it is stored, and with whom it is shared.
2. Scope and definitions
- "Extension" means the NovaBlock browser extension.
- "Site" means novablock.app.
- "Local storage" means
chrome.storage.local(or the Firefox equivalent) — storage on your own device, scoped to the extension and readable only by it. - "Browser sync" means
chrome.storage.sync, your browser vendor's own settings-sync service. - "We", "us" means the controller named above.
3. What data we collect
3.1 Data the extension processes only on your device — never transmitted
| Pages you visit | URLs are evaluated against filter lists inside the browser engine. NovaBlock never receives, logs or transmits them. |
| Page content and form input | Cosmetic filtering, cookie-banner removal and the AI clutter detector run entirely in the page. Nothing is read out or sent. |
| Blocked-request URLs | The blocking engine (Declarative Net Request) runs in the browser process by design; the extension is never told which individual requests were blocked. |
| "Blocked on this page" count | Read from the browser on demand while the popup is open, shown, and discarded. Never stored, never transmitted. |
| Custom and learned filter rules | When you report an ad, the selector and the site's domain are turned into a rule locally. No report is sent to us. |
| Activity feed | Held in memory only and lost when the browser closes. |
3.2 Data the extension sends to novablock.app
| Data | When | Contents |
|---|---|---|
| Entitlement check | Periodically, and on start-up | A random per-install device token, plus your licence key if you have entered one. If you are signed in, your account is checked instead and no device token is sent. |
| Aggregate block counters | Only while signed in | Device token and whole-number totals: ads, trackers, cookie banners, fingerprinting, malware, overall total, and a timestamp. No URLs, no domains, no per-site data, no timestamps of individual blocks. These populate the dashboard on your account page. |
| Account requests | When you sign up, sign in, verify two-factor, refresh a session, change your password or set your name | Email address, password, name, and session/refresh tokens as applicable. |
| Diagnostic preferences | When you toggle them | Two true/false values recording whether you have opted in to crash reporting and to analytics. |
3.3 Data stored on your device
Local storage holds: your settings; block statistics; your custom and learned rules; the random device token; your subscription state; and, if you sign in, your email address, display name, user ID, session token, refresh token and session expiry. This data stays on your device unless a row in section 3.2 applies.
3.4 Data synchronised by your browser
If your browser's own sync is enabled, your settings and custom rules are stored in browser sync so they follow you between devices. Your licence key and Premium tier are deliberately excluded. This service is operated by your browser vendor (Google or Mozilla) under their privacy policy, not ours — we cannot read it.
3.5 Website data
The Site processes standard server request data (IP address, user agent, requested page) for delivery and security. If analytics is enabled it uses Cloudflare Web Analytics, which is cookieless and does not fingerprint or track individuals across sites. Analytics runs on the Site only; the extension contains no analytics code.
3.6 Payments
Payments are processed by Stripe. We never receive or store your card number. Stripe passes us a customer ID, a subscription ID and the email address on the account so we can activate your licence.
3.7 Support
If you contact us, we keep your message, your email address and our reply.
3.8 Crash reports — opt-in, off by default
If you enable crash reporting, errors are sent to Sentry. Only exceptions originating in NovaBlock's own code are sent: a filter checks each event's stack trace and discards anything else, and performance tracing is disabled. Reports contain the error type, message, stack trace, extension version and browser version. They do not contain browsing history, page content, URLs of pages you visited, or the contents of your filter rules.
3.9 Data we never collect
We do not collect browsing history, keystrokes, form input, page content, cookies from sites you visit, screenshots, location data, contacts, or device identifiers such as advertising IDs. We do not build profiles and we do not sell, rent or trade personal data. NovaBlock contains no advertising or data-broker SDKs.
4. How we process your data, and on what legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Delivering the blocking service | On-device data only (section 3.1) | Performance of a contract |
| Confirming Premium entitlement | Device token, licence key, or account identity | Performance of a contract |
| Operating your account and keeping you signed in | Email, name, password hash, session tokens | Performance of a contract |
| Showing your dashboard statistics | Aggregate counters, device token | Performance of a contract |
| Taking payment, renewals and refunds | Stripe customer ID, subscription ID, email | Performance of a contract; legal obligation for tax records |
| Answering support requests | Your message and email | Legitimate interests (responding to you) |
| Fixing crashes | Crash reports | Consent — you switch it on |
| Understanding aggregate website usage | Cloudflare Web Analytics | Consent — you switch it on |
| Preventing fraud and licence abuse | Device token, licence key, subscription state | Legitimate interests (protecting the service) |
We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not use it for profiling or advertising.
5. Where your data is stored, how it is protected, and for how long
On your device.
Settings, statistics, rules, tokens and the device token live in extension-scoped local storage. Only NovaBlock can read it. Removing the extension deletes it. You can also clear it from the extension's settings.
On our servers.
Account records, subscription state and aggregate counters are held in a Lovable Cloud PostgreSQL database in the EU (Ireland). Access is restricted by row-level security so a signed-in user's session can reach only their own rows. Traffic is encrypted with TLS; passwords are hashed and never stored in plain text; administrative access is limited to staff who need it.
With processors.
Stripe and Sentry hold data on their own infrastructure under their own security programmes (section 6).
Retention:
| Data | Kept for |
|---|---|
| Account record and subscription state | Until you delete your account, then removed within 30 days |
| Aggregate block counters | Until you delete your account, or until you sign out and request removal |
| Payment and invoice records held by us | 7 years, to meet tax and accounting obligations |
| Crash reports | 90 days, then deleted by Sentry |
| Support correspondence | 24 months |
| Website server logs | 30 days |
| Anonymous website analytics | Retained by Cloudflare in aggregate; contains no identifier for you |
6. Who we share your data with
We do not sell personal data, and we do not share it for advertising or marketing by anyone.
We use the following processors, each under a data-processing agreement:
| Processor | Purpose | Data they receive |
|---|---|---|
| Stripe | Payment processing, subscription billing | Your billing details, card data (directly — we never see it), email |
| Sentry | Crash reporting — only if you opt in | Error type, stack trace, extension and browser version |
| Cloudflare | Website delivery, security, and cookieless analytics if enabled | IP address and request metadata at the edge; aggregate page views |
| Lovable Cloud | Hosting the account database and API | Account record, subscription state, aggregate counters |
| Your browser vendor (Google or Mozilla) | Browser-native settings sync, if you have it enabled | Your settings and custom rules — under their policy, not ours |
We may also disclose data where we are legally required to, or to establish or defend legal claims. If we ever do so in response to a government request, we will tell you unless prohibited by law.
International transfers.
Some processors are based outside the UK/EEA. Where that is the case, transfers are made under the European Commission's Standard Contractual Clauses or an adequacy decision.
7. Permissions the extension requests, and why
| Permission | Why it is needed |
|---|---|
| declarativeNetRequest | Applies the filter lists inside the browser engine. This is what makes blocking possible without NovaBlock seeing your requests. |
| Access to all sites | Required to inject cosmetic filtering and the privacy shield on any page you choose to browse. It is used to modify pages locally; it is not used to read or transmit their content. |
| activeTab | When you open the popup, lets NovaBlock ask the browser how many requests it blocked on that one tab. Granted only by your click, for that tab, and the answer is discarded when the popup closes. |
| storage | Saves your settings, statistics and rules on your device. |
| tabs | Tells the popup which site you are on so it can show the right controls. |
| alarms | Schedules periodic entitlement checks and resumes protection after a timed pause. |
| contextMenus | Adds the right-click menu items. |
| offscreen (Chromium only) | Runs the optional on-device image classifier. It processes images locally and sends nothing. |
NovaBlock does not request the scripting permission, and does not request declarativeNetRequestFeedback — the debug permission that would expose individual blocked requests to the extension.
8. Your choices and your rights
In the extension.
You can turn Premium features, crash reporting and analytics on or off at any time; pause protection; allowlist any site; export or delete your local data; and reset your statistics. Crash reporting and analytics are off until you turn them on, and a response from our server can never switch them on for you.
Your rights.
If you are in the UK, EEA or a jurisdiction with comparable law, you have the right to access your data, to correct it, to delete it, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out.
How to exercise them.
Email privacy@novablock.app from the address tied to your account. We respond within 30 days. Deleting your account from the account page removes your account record, subscription state and stored counters.
Complaints.
You may complain to your local supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Children
NovaBlock is not directed at children under 13 and we do not knowingly collect personal data from them. NovaBlock's Family Protection feature blocks gambling and adult sites; it operates entirely on-device using a local filter list and collects no information about who is browsing. If you believe a child has given us personal data, email privacy@novablock.app and we will delete it.
10. Changes to this policy
We will update this page when our practices change and revise the "Last updated" date. If a change materially affects how we handle your personal data, we will give notice in the extension or by email before it takes effect. Previous versions are available on request.
11. Contact
Privacy enquiries and data requests: privacy@novablock.app