Privacy.
Made clear.

01 / SCOPE & CONTACT

What this policy covers

SGRIZ.IT is a desktop Chrome extension for reviewing web pages with a grid, notes, drawings and screenshots. No account is required. This policy also covers the Sgrizzy support form on sgriz.it.

For privacy questions and requests concerning SGRIZ.IT, contact app@sgriz.it. This is the contact address configured for the service’s support messages and usage notifications.

02 / LOCAL REVIEWS

Your working data stays in your browser

When you activate SGRIZ.IT, it works with the current page to display its review tools. Local review data includes the page URL (including its path and query parameters, with the fragment removed), page title, notes and their status and priority, drawings, grid settings, selected coordinates, panel position, viewport size and timestamps. Screenshot filenames and capture metadata may also be stored with a review.

In the Chrome extension, drafts and saved review versions are kept in chrome.storage.local. Language, grid preferences and the latest usage-service result are also stored there. These records are not sent to the SGRIZ.IT server or synchronised through an SGRIZ.IT account.

When you request a screenshot, Chrome captures the visible area of the active tab. The image is processed locally and can include visible page content, notes and drawings. You choose whether to save a PNG. Exported JSON contains review data, including the page URL and title, but does not include the PNG image itself. Importing a JSON file processes it locally.

Annotations are displayed in the visited page’s document, inside an open shadow root. Scripts running on that website may be able to read them. Avoid entering secrets or other sensitive information. Review exported files and screenshots before sharing them; sharing is an action you take yourself.

03 / DOMAIN USAGE RECORDS

What leaves your browser

Each successful new opening of the Sgriz Panel on a supported site triggers a usage request. Updating an already open panel’s settings does not create another event. The extension does not passively record browsing or report other tabs.

The request sends only a hostname, including any subdomain, such as shop.example.com, to https://www.sgriz.it/api/usage.php or https://sgriz.it/api/usage.php. It does not send the full page URL, path, query parameters, fragment, page title, notes, drawings or screenshots. Known local and reserved hostnames and numeric IP addresses are excluded by the extension’s validation; this is not a guarantee that every private hostname can be recognised.

The server adds the date and time in the Europe/Rome timezone and attempts to append the hostname and timestamp to a private text log. It also attempts an email to app@sgriz.it containing the hostname, timestamp and whether saving to the text log succeeded. The notification is attempted even when saving fails, subject to mail availability and rate limits. Mail-service acceptance does not guarantee inbox delivery.

These records let the operator see where and when the tool is activated and whether the logging service is working. They contain no installation identifier or account ID, but a hostname can itself reveal personal or confidential information. The record is not anonymous merely because it omits the full URL.

Connection checks contact the same endpoints without recording a domain or sending a usage email. Usage requests omit cookies and the HTTP referrer. As with any network connection, the hosting infrastructure receives the connecting IP address and request information; normal technical hosting logs are separate from the application’s domain-and-time log. A network failure does not prevent local review work.

04 / CHROME PERMISSIONS

Access follows your action

activeTab

Provides temporary access to the tab you choose to activate, including the visible-tab capture used for screenshots.

scripting

Inserts and updates the grid and review tools in that tab.

storage

Saves local reviews, settings, language and usage diagnostics.

Host access to sgriz.it and www.sgriz.it

Allows the background service to contact the fixed HTTPS usage endpoints described above. The manifest does not request general persistent access to every website.

05 / SUPPORT & COOKIES

When you ask Sgrizzy a question

If you submit the website’s support form, it sends your name, reply email address, question, optional website URL, selected website language and submission time to app@sgriz.it through the server’s mail service. These details are used to receive and answer your request. They are not added to the extension’s domain usage log or published by the form. Messages you send directly by email are also received in that mailbox.

The form uses a first-party session cookie named sgriz_contact for its arithmetic spam check and request protection. Server-side session state holds the challenge and submission counters. A challenge expires after ten minutes; the session’s submission budget uses a one-hour window. These are validation windows, not guaranteed deletion times for session files.

The supplied website code contains no advertising trackers or third-party analytics scripts. The privacy page itself contains no scripts, forms, remote fonts or embedded third-party content and does not set an application cookie. The support form on the home page starts its technical session when it loads.

06 / RECIPIENTS & SECURITY

Where transmitted data goes

The SGRIZ.IT operator receives the usage records and support emails described above. The project is configured for Aruba hosting; the hosting infrastructure processes website and API requests, and the configured server mail service and receiving mailbox infrastructure handle emails. The source files do not identify all mail subcontractors, processing locations, international transfer arrangements or hosting-log settings.

The reviewed implementation contains no sale of data, advertising integration, credit-scoring feature or automatic upload of review files to another service. If you follow an external link, open another website or share a file yourself, the destination’s practices also apply.

The extension sends usage data over HTTPS. The text log is placed in a directory configured to deny public HTTP access, with restrictive file permissions. The APIs validate input and use rate limits; the support form also uses a session-bound challenge. These protections depend on correct server deployment. Email transport and mailbox security depend on the configured providers; this policy does not promise end-to-end encrypted email.

07 / RETENTION & CHOICES

Keep, export or remove your work

Local reviews: drafts and preferences remain in the extension’s local storage until removed or overwritten. Saved history is limited to the latest 20 versions per page and may be shortened by size limits. Removing a note or starting a new review does not necessarily remove older saved versions. To remove all extension-local data, uninstall the extension. Export anything you want to keep first.

Saved files: PNG and JSON files remain wherever you save them until you delete them, including any copies or backups you create. Uninstalling the extension does not delete those files.

Server records and correspondence: the supplied application has no automatic deletion schedule for the domain usage log or emails. The log stops accepting new entries at its size limit rather than automatically expiring old entries. Retention of emails, hosting logs, backups and PHP session files depends on the operator and provider settings; no fixed period is specified in this policy.

There is no separate telemetry opt-out switch in version 0.2.9. Opening a new panel on a supported site triggers the domain request described above; stop activating or uninstall the extension to stop future requests. Closing the panel or uninstalling does not erase existing server records.

Contact app@sgriz.it to ask about data held by the service or request access, correction or deletion where applicable. Domain records contain no user ID, so the operator may be unable to identify a record as yours from the domain alone. Local reviews cannot be retrieved from the SGRIZ.IT server. You can also use this address to ask for further information about server-side retention and the service operator.

08 / CHROME WEB STORE

Limited Use

SGRIZ.IT’s use of information received through Chrome APIs is limited to the review features and related operational purposes described in this policy and follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Such information is not used for personalised advertising, sold to data brokers, or used to determine creditworthiness or lending eligibility.

09 / CHANGES

A policy that follows the product

This policy describes the supplied version 0.2.9 implementation. Updates to how SGRIZ.IT handles data will be reflected on this page with a revised update date.