Privacy policy
Last updated: 28 October 2026
Short version: the VeilKit extension never sends the content of the pages you visit anywhere. We only process the minimum needed to sell and check licenses.
1. Who we are
VeilKit (“we”) is the data controller for the data described here. Contact: veilkit-support@bauxitelabs.com. VeilKit is a product of Bauxite Labs, Belagavi, Karnataka, India.
2. What the extension does on your device
- It changes the CSS of pages you choose to blur. This happens entirely in your browser.
- Keep Blur saves, in your browser's extension storage, a URL key (an origin, path or full URL), element locators (ids, test attributes, CSS selectors, XPath) and rectangle coordinates. Locator values that look like content (emails, long numbers, sentences) are discarded. It never stores the text, images or other content that was blurred.
- Auto-blur pattern matching (emails, card numbers and so on) runs locally, and its results are never stored or sent.
- The page script has no analytics, telemetry or third-party code.
- If you turn on sync (off by default), the saved locators are stored in your browser vendor's sync storage (for example your Google account in Chrome), under that vendor's privacy terms.
3. Data we process
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Purchase email, plan, payment reference | Deliver and support your license | Contract (Art. 6(1)(b)) | Life of the license + 6 years for tax records |
| License key (stored only as a keyed hash) | Validate activations | Contract | Life of the license |
| Device name you choose, browser name, random install ID, last check-in date | Enforce and manage seats | Contract | Until deactivated + 12 months |
| Hashed IP address in rate-limit counters | Prevent abuse of license endpoints | Legitimate interest (Art. 6(1)(f)) | Overwritten within 24 hours |
| Sign-in link tokens (hashed) | Passwordless login | Contract | 15 minutes validity, purged after 30 days |
We do not sell personal data or use it for advertising. The website does not use tracking cookies; the only cookie is a session cookie after you sign in to My Account.
4. Processors
- Razorpay processes payments (UPI and cards). We never see full card numbers.
- Resend sends license and sign-in emails.
- Vercel hosts the website and API; the database is Neon Postgres in AWS US East (N. Virginia).
Where data leaves the EEA/UK, these providers rely on Standard Contractual Clauses or an adequacy decision.
5. Your rights
You can ask to access, correct, export or delete your data, object to processing, or complain to your data-protection authority. Email veilkit-support@bauxitelabs.com. Deleting your data ends your license, because we can no longer verify it. You can deactivate browsers yourself at any time in My Account.
6. Children
VeilKit isn't directed at children under 16, and we don't knowingly collect their data.
7. Changes
We'll post changes here and, for material changes, email license holders.