OFFICIAL PRIVACY POLICY ✓ 100% LOCAL & ZERO TELEMETRY MANIFEST V3

Vellum — Quiet Privacy & Ad Shield

EXTENSION VERSION: v2.4.0 EFFECTIVE DATE: OCTOBER 20, 2026 STATUS: ZERO DATA COLLECTION

Short Summary: We Collect Nothing.

Vellum operates 100% locally on your device. We do not have backend servers, we do not run analytics or telemetry, and we never collect, log, store, transmit, or sell your browsing history, IP address, visited websites, or personal data.

01 Zero Data Collection Policy

Vellum ("the Extension") is engineered from the ground up as a local-first browser sanctuary. Every anti-fingerprinting disguise, ad-blocking rule, and malware heuristic executes strictly inside your own browser instance.

No Personal or Browsing Data Collected: Vellum does not collect, read, log, transmit, or share your browsing history, visited URLs, search queries, form inputs, cookies, authentication credentials, IP addresses, or device identifiers.
No External Servers or Analytics: Vellum makes zero outbound network connections to any developer server, cloud API, or third-party telemetry/analytics provider.
100% On-Device Storage (chrome.storage.local): Your user preferences—such as whether the "Enhance Security and Block Ads" toggle is enabled, your active hardware disguise profile, and your personal list of whitelisted websites—are saved strictly inside your browser's local storage on your machine and never leave your device.
No Remote Code Execution: All JavaScript modules and Declarative Net Request (DNR) rulesets are bundled inside the signed Chrome Web Store package. Vellum never fetches or evaluates remote scripts or external filter lists.

02 How Browser Permissions Are Used Locally

To protect your browser across the web, Vellum requests only the minimum Manifest V3 permissions required to perform local network filtering and entropy masking:

Permission	Strict Local Purpose
`<all_urls>` & `scripting`	Required to inject Vellum's deterministic anti-fingerprinting hooks (Canvas, WebGL, WebAudio, Font Metrics, Navigator, Timezone) and surgical cosmetic ad-slot cleanup before third-party tracking scripts can fingerprint your device.
`declarativeNetRequest` & `declarativeNetRequestWithHostAccess`	Uses Chrome's native Manifest V3 Declarative Net Request engine to block known third-party advertising networks, cross-site tracking beacons, and strip tracking URL parameters (such as `utm_*`, `fbclid`, and `gclid`) locally.
`storage`	Stores your toggle states, selected hardware disguise persona, session seed, and whitelisted sites locally on your computer via `chrome.storage.local`.
`tabs` & `webNavigation`	Used locally to display the active tab's domain name in the Vellum popup for one-click site whitelisting, and to show a local security interception warning page if you navigate to a deceptive punycode or malware domain.
`privacy`	Used locally to configure Chrome's built-in WebRTC IP handling policy (`disable_non_proxied_udp`) so websites cannot leak your local LAN or VPN-bypass IP address via STUN requests.

03 Chrome Web Store Limited Use Disclosure

Vellum's use of information received from Google Chrome APIs adheres strictly to the Chrome Web Store Developer Program Policies, including the Limited Use requirements:

We do not collect, transfer, or sell any user data to third parties, advertising platforms, data brokers, or information resellers.
We do not use or transfer any user data for serving personalized, retargeted, or interest-based advertisements.
We do not use or transfer any user data to determine creditworthiness or for lending purposes.

04 Terms of Use & Legal Disclaimer

Vellum is provided "AS IS" and "AS AVAILABLE" without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and non-infringement.

Lawful Defensive Privacy Use: Vellum is designed solely as a defensive privacy and security tool to protect everyday users from intrusive advertisements, cross-site browser fingerprinting, and deceptive phishing/malware domains.
Website Compatibility & Whitelisting: Because Vellum masks hardware entropy APIs and blocks third-party tracking scripts, certain websites that rely on strict device fingerprinting may behave differently. You can pause protection on any website with a single click using the Protected / Whitelisted button in the Vellum popup.
Limitation of Liability: In no event shall the authors, developers, or contributors of Vellum be liable for any direct, indirect, incidental, special, exemplary, or consequential damages arising out of the use or inability to use the Extension.