Privacy policy

Last updated 26 September 2026

Who is responsible

Invisible Shapes, Waterlei 248, 7325 GL Apeldoorn, the Netherlands (KvK 70894884) is responsible for the data described here. Questions or requests: hello@cookiechomper.com.

What stays on your device

The extension stores these in your browser and never sends them anywhere: your settings and the sites you paused; how each site's banner was refused, so the next visit needs no work, and which sites it already said no on, so it can leave cookie settings you open yourself alone; and a short log of recent activity, shown in the toolbar popup. Removing the extension deletes all of it.

Banners the built-in rules don't recognise

Banners from the well-known consent platforms are handled locally by open-source rules. For any other banner, the extension sends:

• the site's host name (for example example.com, never the rest of the address);
• the page language;
• the text of the banner and the labels of its buttons and switches.

It never sends the page title, the rest of the page, form contents, your cookies or anything that identifies you. This goes to our server, which passes it to TypeSafe's AI model to decide which button refuses tracking, and returns the answer. Our server doesn't store it. TypeSafe processes it on our behalf, only to produce that answer.

Your trial and subscription

When you install the extension, our server creates a random install ID. It stores that ID, when it was created (for the 14-day trial), and, once you subscribe, which Paddle subscription belongs to it and its status. The install ID is not linked to your name, email address or browsing.

Using your subscription on another browser

If you ask to restore your subscription, the extension sends the email address you enter to our server. We use it once: to ask Paddle whether that address has a Cookie Chomper subscription, and if it does, to email you a one-time link through our email provider, Resend. We don't store the address. We keep only a scrambled (hashed) copy of the link's code, which stops working after 30 minutes or its first use.

Payments

You subscribe on Paddle's checkout. Paddle is the merchant of record: it collects your payment details, email address and billing country, and handles VAT and invoices under its own privacy notice. We receive the subscription's status and a Paddle customer ID, never your card details.

This website and our server

This website sets no cookies and uses no analytics. It and our server run on Cloudflare, which keeps technical request logs (time, route, response code and the connecting IP address) for a few days, to operate and protect the service. We don't log banner text or host names.

Who processes data for us

Legal basis

Sending an unrecognised banner to be refused is necessary to provide the service you installed (GDPR Article 6(1)(b)). Subscription records are needed for the contract and for tax law (Article 6(1)(b) and (c)). Server logs are kept for our legitimate interest in running a secure service (Article 6(1)(f)).

How long we keep it

• Banner contents: not stored by us.
• Install ID and subscription status: while the trial or subscription is current, and deleted 12 months after it ended.
• Paddle keeps billing records for as long as tax law requires.

Your rights

You can ask for access to, correction or deletion of your data, object to its processing, or ask for a copy. Because we don't know who you are, include the email address you used with Paddle when you write to us. You can also complain to your data protection authority; in the Netherlands, that's the Autoriteit Persoonsgegevens.

Changes

When this policy changes we update this page and the date above, and mention material changes in the extension's release notes.