---
title: "Confidentialité de l’extension SYBA Shield"
description: "La confidentialité de l’extension SYBA Shield : ce qu’elle lit dans le navigateur, ce qu’elle envoie, à qui, et combien de temps ces données sont conservées."
canonical: https://sybainsurance.com/fr-BE/privacy/extension
---

Legal · Browser extension

# SYBA Shield extension privacy policy

This is the complete and self-contained privacy disclosure for the SYBA Shield browser extension, listed on the Chrome Web Store as “SYBA Cybersecurity Agent”. It covers every category of data the extension can access, how that data is used, where it is stored, how long it is kept, and every party it is shared with. It applies in addition to the general [Syba privacy policy](https://sybainsurance.com/fr-BE/privacy); where the two differ for the extension, this page governs.

## 1. Who we are and how to reach us

The SYBA Shield extension is published by Syba Security Inc. (US headquarters: 2972 Webb Bridge Road, Alpharetta, GA 30009; EU entity: Syba Europe BV, Katelijne Business Center, Baron Ruzettelaan 5/1.1, 8000 Brugge, Belgium). For any privacy question about the extension, email [customer.service@syba.io](mailto:customer.service@syba.io) or [support@sybainsurance.com](mailto:support@sybainsurance.com).

## 2. Single purpose

SYBA Shield has one purpose: to detect and warn you about phishing pages, lookalike domains, and malicious links while you browse. Every permission it requests and every piece of data it touches exists to serve that purpose. The AI phishing tiers (on-page vision scanning, link-reputation checks, and the optional email scanner) serve this same single purpose. The AI email scanner is governed by a consent toggle that is off by default and revocable at any time; the on-page vision scan can be switched off in settings. The extension does not sell your data, does not use it for advertising, and does not transfer it to data brokers.

## 3. Data we collect, and how each type is handled

The list below covers every category of data the extension can access. The core checks (URL heuristics, page signals and the bundled blocklist) run *on your device* and send nothing. Everything that leaves your device is named below, with when it happens and who receives it. Most of it needs you to be signed in; the exceptions are said where they apply.

- Web page URLs and page titles.The address and title of pages you visit, and the URLs of the network requests those pages make, are inspected on your device by the extension’s offline heuristics (lookalike-domain, IDN-homograph, suspicious-TLD, IP-literal, and embedded-credential checks). That inspection sends nothing. A page address does leave your device in the specific cases named below: a vision scan, the site report while the side panel is open, a page flagged as phishing while you are signed in, a report you send, and the live-protection lookups. We do not upload a log of the pages you visit.
- Website content: page-structure signals.A content script reads passive structural signals from the pages you visit (for example, whether a password field submits to a different domain, or whether a login form is themed for one brand but hosted on another). This runs on your device; only derived true/false signals reach the extension’s own background process. We do not collect keystrokes, passwords, form values, or full page text.
- Website content: screenshots, on the vision scan. The extension captures an image of the visible browser tab and sends it, with that tab’s URL and title, through Syba’s servers (sybainsurance.com) to OpenRouter, which routes it to a vision-AI model (Google Gemini by default) to judge whether the page is a phishing page. This happens when you click “Scan now”, and also automaticallywhile you are signed in with the “Vision scan” setting on (it is on by default) and the page already shows a phishing signal: a medium- or high-severity URL or page finding. The automatic check runs when a page loads, when you switch to a tab, when a page changes, and on a 5-minute safety net; it never captures a page on Syba’s curated safe list, a page with no such signal, or any page while you are signed out. Turn “Vision scan” off and the extension only captures when you click. If you paste your own OpenRouter key instead of signing in, “Scan now” sends the screenshot, URL and title directly from your browser to OpenRouter. The keyboard shortcut Ctrl+Shift+Y (Cmd+Shift+Y on a Mac), “Ask SYBA about this screen”, is the same manual scan: it sends the same redacted screenshot, with the tab’s URL and title, to the same scan route under the same consent and settings as “Scan now”. A screenshot may contain whatever is visible on that page at that moment.
- Email content: only with your affirmative consent (off by default). SYBA Shield includes an AI email-phishing tier governed by a dedicated consent toggle that is off by defaultand revocable at any time. When, and only when, you turn it on, the content of an email you OPEN in Gmail or Outlook on the web (its sender, subject, body text, and the destination URLs of its links) is sent through Syba’s servers to OpenRouter, which routes it to an AI model (Google Gemini by default, with the fallbacks named in section 6) to classify whether the message is a phishing attempt. With that toggle off, the email’s content stays on your device. Separately, while Live protection (below) is on, the destination URLs of the email’s links and the sender’s domain are checked on Syba’s servers whether or not this toggle is on.
- Live protection: link and URL destinations.Behind a switch named “Live protection from SYBA”, shown with this disclosure on first sign-in, on by default for a company seat and off by default for a personal account(a personal account that turns on AI cloud scanning gets it on too), and reachable at any time under Settings, Privacy & AI. With the switch on:

  - When you open an email, the address of each link (notthe email’s content, and notyour browsing history) is sent to Syba’s proxy, which strips credential-bearing parts (query tokens, fragments, basic-auth) before asking any source. The sender’s domain is checked the same way. A link lookup asks the public domain registry (RDAP) how old the domain is and compares the host with the Certificate Transparency lookalike-certificate list; rdap.org receives only the domain name.
  - When you run a scan, short SHA-256 hash prefixes of the page address are compared with Syba’s mirror of the Google Web Risk list; a prefix is a short fingerprint many addresses share, not the address itself, and the final match is decided on your device.
  - When you open a page that is not on Syba’s list of known sites, its domain name alone (for example example.com, never the page address) is sent to Syba’s proxy, which asks the public domain registry (RDAP) how old the domain is and checks the domain against the Certificate Transparency lookalike-certificate list, and marks one registered in the last 30 days or on that list as suspicious. No paid scanner is asked about a page you visit. The answer is kept on your device, so an established site is asked about roughly once a month at most. On the same visit, short SHA-256 hash prefixes of the site name are compared with Syba’s mirror of the Google Web Risk list.

  With the switch off, no address or domain leaves your device for these checks.
- On-device AI tier.Where Chrome’s built-in language model is available, the extension asks it for a verdict first. It reads only the page URL and title, runs entirely on your device, makes no network call, and the extension never triggers the model download.
- Signed configuration and blocklist updates. Every 15 minutes the extension downloads a small configuration file from sybainsurance.com, and on the schedule that file sets (never more often than every 15 minutes) a list of newly reported phishing sites, which it adds to the blocklist it already carries. These requests carry no account, no cookie, no access token and no page data; like any web request they reach our host with your IP address. Every file is signed with a key Syba holds offline, and a file whose signature does not check out, that has expired, or that is older than the one already applied is ignored. The configuration can only switch parts of Syba’s own detection off, for example to stop a faulty check without waiting for a Chrome Web Store update. It cannot run code, change your settings, or turn off a block your employer set.
- Your Syba plan and your dashboard activity.When you are signed in, the extension asks sybainsurance.com whether your Syba plan includes it, at most every few minutes, with a request that carries only your sign-in token. Only when your plan includes it, and only while “Show my activity in my Syba dashboard” is on, the extension sends what it blocked, warned about or scanned, in batches: the kind of event, a severity, a short title and detail, the time, and the site name alone (for example https://example.com, never the page address, its path or query string, the page content or any email text). These events are shown to you at sybainsurance.com/dashboard/extension. Without a plan nothing is sent, and switching the setting off clears anything still waiting on your device.
- Authentication information.If you choose to sign in with your Syba account, we issue a rolling 30-day opaque access token. It is stored in your browser’s local extension storage and, as a hashed reference, on our servers. It is used only to authorize the extension’s API calls (vision verdicts, the safety co-pilot chat, live protection, the site report, your account timeline, subscription-tier lookup, the plan check and the dashboard activity feed) and is revocable at any time.
- Safety co-pilot chat messages.If you open the side panel and send a message to the Syba agent, the text you type (and, if you attach the current page for context, that page’s URL and title) are sent through Syba’s servers to the AI model to generate a reply. If you ask it to, the agent can check a URL’s reputation (as in Live protection, whatever that switch is set to) or check an email address for known breaches (see Have I Been Pwned in section 6).
- Site report (signed in, side panel open).While the side panel is open, the host and address of the page you are viewing and its on-device verdict are sent to Syba’s servers, which request that site’s HTTP headers from it to grade its security, and show you the result.
- Account timeline (signed in). When a page is flagged as phishing, its address, host and the reasons are stored with your Syba account so you can review them later.
- Reports you send.“Report phishing” sends the page address to Syba. Marking a page “not phishing” sends only its host, including when you are signed out.
- Sign-in check. Every 5 minutes, signed in or not, the extension asks sybainsurance.com whether you are signed in, using your sybainsurance.com cookie if one exists, so a sign-in on the website can be connected to the extension.
- Settings and local cache. Your preferences, per-site allowlist, recent verdicts, and scan history are stored locally via chrome.storage.local on your device. They are not synced across devices and are not transmitted to us. An optional OpenRouter API key you enter is stored locally and is never sent to Syba.
- Protection counters (extension v1.16.0 and later). So that you, and your employer if you use Syba at work, can tell whether the protection actually worked, the extension keeps four small counters. They hold whole numbers and fixed labels only. None of them has a field that could carry a web address, a page title, page content, a screenshot, an email, or anything you typed.

  - detections — how often a page was judged dangerous, counted every time, including when the warning was held back by your own settings. Stays on your device.
  - outcomes — what the extension did with each detection, as one of nine fixed labels: blocked, softened to a banner, undeliverable, one of four suppressed reasons, a repeat inside the dedup window, or unclassified. Stays on your device.
  - adherence — what you did with a warning, as one of five fixed labels: left, continued once, trusted the site, closed the tab, or unresolved. Stays on your device.
  - health — whether this browser was actually protected: protection on or off, permissions granted, notifications granted, the intervention mode, and whether the policy and blocklist are current. Ages are reported as fresh / stale / expired buckets rather than exact times, so the report cannot become a fingerprint. This is the only one that leaves the device, it is sent to your employer’s console only if you hold a company seat, and a personal install never contacts that endpoint at all.

  If you already had the extension installed when this changed, it showed you a one-time notice in the side panel rather than relying on this page alone.

We do not collect health, financial, or location data; we do not use analytics SDKs or third-party trackers inside the extension; and we do not upload a log of the pages you visit. What Syba keeps on its servers is listed in section 5.

## 4. How we use the data

- To produce the green / amber / red safety verdict for the page you are on.
- To run the vision scan (when you click, or automatically on a page that already shows a phishing signal while you are signed in) and return its findings.
- To classify an email you open as phishing or safe, only if you have turned on the optional, consent-gated AI email-scanning tier (off by default).
- To check the reputation of the links, domains and addresses named under Live protection, with the sources listed below.
- To grade the security of the site you are viewing in the side panel’s site report, and to keep flagged pages on your account timeline.
- To answer the questions you ask the safety co-pilot chat.
- To apply the correct rate limits and feature flags for your subscription tier.
- To notify you when a page is flagged as phishing or a high-severity network request fires (only if you enable notifications).

We do not use your data for advertising, profiling, creditworthiness or lending decisions, or for any purpose unrelated to the security features above.

## 5. How we store it

- On your device. Settings, allowlist, recent verdicts, scan history, and any OpenRouter key live only in chrome.storage.local. Removing the extension deletes them.
- On our servers. A hashed reference to your access token and your subscription tier, so we can validate and revoke the token; the latest reputation result for each checked address and the latest site report for each host, so repeat checks are fast; the phishing events on your account timeline; and the reports you send. Vision-scan screenshots and email content are processed to produce the verdict and are not stored on our servers.

## 6. How we share it, and every party it is shared with

We share data only as needed to deliver the scan or chat you request. The full list of parties:

- Syba’s servers (sybainsurance.com), hosted on [Netlify, Inc.](https://www.netlify.com/privacy/) When you are signed in, your scan screenshot, page URL/title, chat messages and the live-protection, site-report, timeline and report requests described in section 3 are sent to our servers, which forward only what each lookup needs to the parties below.
- [OpenRouter, Inc.](https://openrouter.ai/privacy) routes vision-scan, email-scan and chat requests to the AI models below.
- AI model providers, through OpenRouter. Depending on the model used, the screenshot and/or text is processed by [Google LLC](https://policies.google.com/privacy) (Gemini and Gemma) or [Anthropic, PBC](https://www.anthropic.com/legal/privacy) (Claude). When the primary model is unavailable, free fallback models from [NVIDIA Corporation](https://www.nvidia.com/en-us/about-nvidia/privacy-policy/) and Poolside, Inc. can be used. With your own OpenRouter key you choose the model, which can include [OpenAI, L.L.C.](https://openai.com/policies/privacy-policy/) (GPT).
- Email content (consent-gated, off by default).Only if you turn on the optional AI email-scanning toggle, the content of an email you open (sender, subject, body, link URLs) is sent through Syba’s servers to [OpenRouter](https://openrouter.ai/privacy) and on to the AI models above for phishing classification. With the toggle off, no email content is shared.
- Live-protection sources.When the live-protection switch is on, the lookups in section 3 go to Syba’s servers and, in turn, to [Google Web Risk](https://cloud.google.com/web-risk)(hash prefixes only) and the public RDAP registry at rdap.org (the domain name only, for its age). The Certificate Transparency lookalike-certificate list is Syba’s own copy, so checking a host against it shares nothing.
- Your own key path. If you provide your own OpenRouter API key instead of signing in, scan and chat data is sent directly from your browser to OpenRouterand never touches Syba’s servers.
- Have I Been Pwned.Only when you ask the chat agent to check an email address for breaches: the lookup sends the first five characters of a SHA-1 hash of that address to the Pwned Passwords range service, or the address itself where Syba’s Have I Been Pwned key is configured.
- The site in your site report.Syba’s servers request that site’s HTTP headers from the site itself; the request comes from Syba, not from your browser, and carries no information about you.
- Legal authorities, only where disclosure is required by law.

Complete sub-processor list.The third parties that may process extension data on Syba’s behalf are: [OpenRouter, Inc.](https://openrouter.ai/privacy) (request routing to the AI models below); [Google LLC](https://policies.google.com/privacy) (Gemini AI models and Google Web Risk); [Anthropic, PBC](https://www.anthropic.com/legal/privacy) (Claude AI models); NVIDIA Corporation and Poolside, Inc. (free fallback AI models, through OpenRouter); Have I Been Pwned (breach lookups you ask the chat agent for); the public RDAP registry at rdap.org (domain-age lookups, a public registry query rather than a contracted processor); and [Netlify, Inc.](https://www.netlify.com/privacy/) (hosting of sybainsurance.com).

We do not sell extension data and do not share it with any party other than those listed above.

## 7. Data retention

Local data persists on your device until you clear it or remove the extension. The payloads sent for AI analysis (page screenshots and, where you have consented, email content) are processed to produce a verdict and are not stored by Syba; what an AI provider keeps is governed by that provider’s own terms. Syba keeps the latest reputation result for each checked address and the latest site report for each host on its servers, reuses a result for 10 to 30 minutes, and replaces it with a newer check after that. Phishing events on your account timeline and the reports you send are kept with your account. Dashboard activity from the extension (the plan add-on above) is kept for 90 days: older events are not accepted and are deleted when new ones arrive, at most the 500 newest are kept, and all of it is erased when you delete your account. Your hashed token is retained while your account is active and is deleted when you sign out, revoke it, or delete your account. To request deletion of your account and associated data, email [customer.service@syba.io](mailto:customer.service@syba.io); we comply within 30 days, subject to legal retention requirements.

## 8. Your choices and controls

- Use it without an account. All on-device protection works with no sign-in. Sign-in is optional and unlocks the cloud vision scan and chat.
- Vision scan. Turn it off in settings and screenshots are only captured when you click “Scan now”.
- Live protection. Turn the “Live protection from SYBA” switch off and no address, domain or hash prefix leaves your device for those checks.
- AI email scan. Off by default; turn it on or off at any time.
- Allowlist. Mark sites you trust so they are not flagged.
- Sign out from the side panel at any time to clear and revoke your token.
- Bring your own key so scan data bypasses Syba’s servers entirely.
- Notifications and network monitoring are optional permissions you grant or deny.

## 9. Children

SYBA Shield is not directed to children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect their data.

## 10. Chrome Web Store Limited Use

SYBA Shield’s use of information received from Google APIs, and all user data it handles, adheres to the [Chrome Web Store User Data Policy](https://developer.chrome.com/docs/webstore/program-policies/limited-use/), including its Limited Use requirements. Specifically: we collect and use user data only to provide and improve the single security purpose described above; we do not sell user data; we do not use or transfer it for personalized advertising, creditworthiness, or lending; and we do not allow humans to read user data except (a) with your affirmative consent for a specific message, (b) as necessary for security or to comply with applicable law, or (c) where the data is aggregated and anonymized for internal operations.

## 11. Security

We use TLS for all network calls, store the access token as a hashed reference, scrub tokens from URLs during the sign-in handoff, and request only the permissions each feature needs. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

## 12. Changes to this policy

We may update this policy as the extension evolves. Material changes will be posted here with an updated effective date; continued use after changes take effect constitutes acceptance.

Effective date: 2026-10-08 · Chrome Web Store item “SYBA Cybersecurity Agent” · © 2026 Syba Security Inc.