Summary
- Reroute stores its data in your browser’s local extension storage. There is no BrowserForge server and no account.
- Reroute contains no analytics, telemetry, crash reporting or advertising code.
- Reroute can make 2 kinds of network request, all optional and listed in full under Network connections.
- Reroute never sells, rents or shares your data with anyone, because it never has it.
- Uninstalling Reroute deletes all of its local data.
Scope
This policy covers the Reroute browser extension for Chrome and Edge, published by Shantanu Ojha under the BrowserForge name (“we”, “us”). It applies to every version of Reroute distributed through the Chrome Web Store, Microsoft Edge Add-ons, or built from the source at GitHub.
This website (BrowserForge pages on shantanuojha.com and its subdomains) sets no cookies, runs no analytics and loads no third-party scripts or fonts. Hosting is provided by Vercel, whose edge servers see the usual request metadata (IP address, user agent) in order to serve pages; we do not enable Vercel’s analytics products.
Data handled
To do its job, Reroute handles the following data. All of it stays on your device unless a row in the network table says otherwise.
- The rules you write or import: patterns, destinations, allowlist entries, and their enabled state.
- Settings, such as whether the tracking-parameter cleaner is on.
- When a rule matches, Reroute necessarily reads the URL being navigated to in order to rewrite it. It does not read page content, form data, cookies or headers, and it does not keep a history of URLs it has rewritten unless you turn on the local debug log, which is off by default and stored only on your device.
- If you activate Pro: your licence key and the resulting entitlement status.
Where data lives
Reroute uses the browser’s extension storage (chrome.storage.local , and chrome.storage.sync if you enable Pro sync) and, where noted,
IndexedDB inside the extension’s own origin. This storage is isolated from websites and from other
extensions. It is not readable by us. We operate no database, no backend and no account system.
Network connections
The complete list of destinations Reroute can contact is below. Each one is optional and off until you turn the corresponding feature on.
| Destination | When | What is sent | What is stored |
|---|---|---|---|
| Lemon Squeezy licence API (api.lemonsqueezy.com) | Only when you enter a Pro licence key, and periodically afterwards to re-validate it (at most once a day, and only if a key is stored). | The licence key you typed and a random instance identifier generated by the extension. No browsing data, no tab or rule contents, no account information. | Whether the key is valid, and the instance identifier, in local extension storage. |
| Your browser vendor’s sync service, through chrome.storage.sync | Only if you turn on cross-device rule sync (Pro). | Your rules, allowlist and settings, encrypted and transported by the browser under your own browser account. BrowserForge has no access to this data. | By your browser vendor, subject to their sync privacy terms; and locally on each device. |
- Optional Pro licence activation. When you enter a licence key, the extension sends the key and a random instance identifier to the Lemon Squeezy licence API to activate and later re-validate it. Nothing else is sent. The response (valid or not, and the licence expiry if any) is stored locally as an entitlement flag.
- Reroute downloads no rule lists at runtime. The tracking-parameter catalog and any curated rule packs are bundled in the extension package and update only when the extension itself updates through the store.
- Cross-device rule sync (Pro) uses chrome.storage.sync, the sync storage built into your browser. Your rules are transported by your browser vendor under your own browser account and never touch a BrowserForge server.
- No other network requests are made.
Lemon Squeezy is our merchant of record for Pro licences. When you buy a licence, your payment details and email address are handled by Lemon Squeezy under its privacy policy . The extension itself never sees your payment details or your email address.
Permissions explained
Every permission in the Reroute manifest is listed here with the reason it is needed. Optional permissions are requested only when you enable the corresponding feature and can be revoked from the extension’s details page in your browser.
| Permission | Type | Why Reroute needs it |
|---|---|---|
declarativeNetRequest | permission | Redirect and rewrite URLs at the network layer without reading the request or response body. |
declarativeNetRequestWithHostAccess | permission | Allow redirect rules with regex substitution to apply on the sites you have granted access to. |
webNavigation | permission | Detect history-state navigations in single-page apps so rules can apply to them. |
tabs | permission | Update the URL of the current tab when a history-state redirect applies, and show the active rule count on the toolbar icon. |
storage | permission | Store rules, allowlist and settings locally, and in browser sync storage if Pro sync is enabled. |
<all_urls> | host permission | Rules can target any site, so redirects must be able to apply on any origin. Reroute does not inject scripts or read page content. |
Retention and deletion
- Rules and settings stay in local storage (and browser sync storage if you enabled Pro sync) until you delete them or uninstall the extension.
- The optional debug log is capped at the most recent 500 entries and can be cleared from the options page.
- The licence entitlement flag is removed when you deactivate the licence or uninstall.
- You can delete everything at once by removing the extension. Chrome and Edge delete an extension’s local storage on uninstall.
Sharing and sale
We do not sell, rent, trade or otherwise share your data with third parties, and we do not use it for advertising, profiling or training. We cannot: Reroute does not send your data to us. The only third parties that can receive data from Reroute are the ones you choose to connect in the network table above, and each of those receives only what that row describes.
Limited Use
Reroute’s use of information received from Google APIs, including Chrome extension APIs , adheres to the Chrome Web Store User Data Policy , including its Limited Use requirements. Specifically:
- Data is used only to provide or improve the user-facing features described on the Reroute listing and product page.
- Data is not transferred to anyone except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with prior notice to users.
- Data is never used or transferred to serve advertisements, to determine credit-worthiness or for lending purposes.
- No human reads your data, because it never leaves your device.
Security
Extension storage is protected by the browser’s process isolation and your operating system’s user account. Backup files you export are ordinary files; protect them as you would any other document that lists the sites you visit. Network connections listed above use HTTPS. The source code is public, so anyone can check that the extension does what this policy says. If you find a discrepancy, please report it (see Contact).
Children
Reroute is a general-purpose tool and is not directed at children under 13 (or the age of digital consent in your jurisdiction). We do not knowingly collect any personal information from anyone, including children. If you believe a child has provided us with personal information by email, contact us and we will delete it.
Changes to this policy
If this policy changes, the new version is published at this address with a new effective date, and the change is noted in the Reroute release notes. If a change would let Reroute send new categories of data anywhere, we will describe it in the extension’s update notes and, where the browser supports it, ask for the new permission explicitly. The history of this document is in the website repository.
Contact
Shantanu Ojha
hello@shantanuojha.com
Security or privacy concerns can also be filed as a GitHub issue, or
by email if they should not be public.