Privacy Policy
Effective and last updated: September 10, 2026
1. Who is responsible
Mask Mate is operated by Ian Richard Hamilton, a sole trader trading as Mask Mate in the United Kingdom. Ian Richard Hamilton is the controller responsible for the processing described in this policy. Privacy questions and requests may be sent to support@getmaskmate.com. If you purchased through a marketplace, that marketplace separately controls the account and transaction information it collects.
2. Extension data processed only on your device
The extension needs access to webpages you choose to use it on so it can display and restore visual masks. Webpage content, DOM content, screenshots, uploaded documents, images, videos, form values, and the contents of redacted elements are processed locally and are not sent to Mask Mate's servers.
The extension stores preferences, saved redaction selectors and settings, license receipts, and an installation identifier in browser local storage. Saved redactions do not intentionally contain the original text or HTML of masked elements. This local information remains until you clear extension storage or uninstall the extension, subject to browser behavior.
3. License activation and validation
When you activate a paid license, the extension sends the license key, a randomly generated installation identifier, and a general device label such as browser and operating-system platform to our HTTPS license service. Later, opening the extension panel can send the signed license receipt and installation identifier to confirm that the entitlement remains valid.
We use this information to authenticate licenses, enforce the installation limit attached to a license, prevent abuse, let users replace eligible installations, and provide licensed functionality. The installation registry stores a cryptographic hash of the license key, a cryptographic hash of each registered installation identifier, its general label, and activation timestamps. It does not store webpage contents or the raw license key in that installation registry.
For purchases fulfilled through AppSumo Licensing API v2, AppSumo sends us the AppSumo-generated license key and lifecycle information such as its tier, status, purchase or activation timestamps, upgrades, downgrades, and deactivation reason. We store that license key and lifecycle information in a separate private licensing database so that we can fulfil the purchase, recognise the key, apply the correct installation limit, process plan changes or refunds, and provide license support. Mask Mate does not create a separate customer account during this process and does not store the temporary AppSumo OAuth access token.
If an administrator manually issues an emergency support replacement, we store a private link between the AppSumo license and the cryptographic hash of the replacement code, together with its tier, status, issue and revocation timestamps, reason, and an optional support note. The plaintext replacement code is not stored in this support-link database. This lets us prevent duplicate issuance and revoke the replacement if the corresponding AppSumo entitlement ends or changes tier.
Processing is necessary to provide the requested licensed service and for our legitimate interests in preventing license abuse and securing the service. License-registration records are retained while the entitlement is active or needed to provide support. After a verified deletion request, associated registration records will be removed from the active service within 30 days, except where retention is required for security, fraud prevention, legal obligations, or legal claims.
4. Website and support data
When you purchase directly through PayPal, PayPal processes your payment and provides us with transaction details needed to fulfil and support the order, such as your name, email address, transaction identifier, payment status, amount, and currency. Mask Mate does not receive your full card or bank-account details. We use the transaction information to confirm payment, deliver the licence, maintain sales and tax records, handle support, and manage refunds or chargebacks.
If you send the contact form or email support, we receive the name, email address, message, and other information you voluntarily provide. We use it only to respond, provide support, protect the service, and keep necessary business records. Routine support correspondence is normally deleted within 24 months after the request is closed unless a longer period is needed for an active dispute, legal obligation, or your continuing customer relationship.
Our hosting provider necessarily processes connection and security information such as IP address, user agent, request time, and requested URL when serving the site or license endpoint. We do not use this information for advertising or cross-site tracking. Security logs under our control are normally retained for no longer than 30 days unless needed to investigate abuse or an incident.
5. Cookies, local storage, and analytics
The public website does not use advertising cookies or analytics cookies. It stores only your acknowledgement of the cookie/privacy notice in browser local storage. Netlify may use strictly necessary infrastructure controls to deliver and protect the website and process the contact form. The browser extension uses its own local storage as described above.
6. Service providers and disclosures
We use Netlify to host the website, receive contact-form submissions, run the license-verification functions, and store private licensing and hashed installation records. Netlify processes information for us under its applicable privacy and data-processing terms. PayPal processes direct payments. Browser marketplaces—including Google, Microsoft, Mozilla, and AppSumo when applicable—process store, account, installation, payment, or purchase information under their own privacy policies.
We do not sell personal information, use it for personalized advertising, or permit humans to read private webpage content through the extension. We may disclose limited information when required by law, to protect users or the service, or to a successor in a merger or sale subject to applicable notice and consent requirements.
7. International processing and security
Providers may process information outside your country, including in the United States, using the safeguards described in their terms and data-processing agreements. License communications use HTTPS. Installation identifiers and license keys in the installation registry are hashed as described above; AppSumo-generated keys are retained separately where needed to operate AppSumo licensing and support. Access to administration functions is authenticated, and we limit collection to information needed for the stated purposes. No system can guarantee absolute security.
8. Your choices and rights
You can remove locally stored extension information by clearing the extension's data or uninstalling it. You may request access, correction, restriction, objection, portability, or deletion of personal information held by Mask Mate by emailing support@getmaskmate.com. Include enough information to identify the relevant license or support request; we may ask for reasonable verification. We aim to respond within one month where GDPR applies.
Residents of the EEA or UK may also complain to their local data-protection authority. Rights can be limited where an exception applies, such as retaining evidence needed for legal claims or fraud prevention.
9. Children
Mask Mate is a general-audience productivity tool and is not directed to children under 13. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to us.
10. Chrome Web Store Limited Use disclosure
Mask Mate's use and transfer of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data accessed through extension permissions is used only to provide or improve the user-facing redaction functionality, is not used for personalized advertising, and is not transferred except as necessary to provide the service, for security, to comply with law, or as part of a properly notified business transfer.
11. Changes and contact
We may update this policy when the product or legal requirements change. Material changes will be identified by a new effective date and, where required, shown prominently before new processing begins. Contact: support@getmaskmate.com.