Privacy Policy
This describes what the MyCliq browser extension looks at, what leaves your computer, what never does, and who can see what. It says the same thing MyCliq tells you on screen the first time it runs — that is deliberate, and we check the two against each other before every release.
The short version
MyCliq checks websites while you use the internet. To do that it has to look at the name of the site you are on. It does not have to know who you are — and it is built so that it cannot.
This is what MyCliq says on screen the first time it runs, word for word:
“To check a website, MyCliq looks up its name. Nobody at MyCliq knows it was you who asked.”
“If you turn on alerts, the people you choose will see the name of any website MyCliq pauses — even for accounts you haven't shared with anyone.”
Everything below is the detail behind those two sentences. If anything here ever contradicts them, the sentences on screen are the ones that govern, and the contradiction is a bug we want to hear about.
What leaves your computer
Most of the time: nothing
MyCliq keeps a list of known-good sites on your own computer and checks against that list first. When a site is on the list — which is the common case for the sites you actually use — nothing about that visit leaves your machine at all.
When MyCliq hasn't seen a site before: the site's name, and nothing else
If MyCliq has no local answer, it asks its server about the registrable domain only — the “example.com” part of an address. That is the entire request.
Never sent, in the request or anywhere alongside it: the full web address, the path, anything after the “?”, your cookies, your browser headers, anything you typed into a form, any value from a field, or the contents of the page.
How the outside check works — and why Google never sees the site you're on
MyCliq uses Google Cloud Web Risk as one of its signals. It uses the Update API, not the Lookup API, and the difference matters to you specifically:
- MyCliq downloads a list of scrambled fragments of known-bad site names and keeps that list on its own server. Downloading it tells Google nothing about anybody.
- If a site you visit matches one of those fragments, MyCliq sends the fragment only to confirm it — never the site name.
So Google never receives the name of a site you visited. We chose the more expensive of the two available methods to keep that true.
What this signal can and can't promise: Google doesn't claim its list of unsafe sites is complete or free of mistakes, and neither do we. A site nobody has reported yet won't be on the list. That's why MyCliq never treats Web Risk as the only word on a site — it's one signal among several, and if this check or another one can't be completed, MyCliq never treats that as a green light. How Google checks websites.
What never leaves — the part that is structural, not a promise
A website check carries no identifier for you. Not your account ID, not an installation ID, not a session token, not a device fingerprint — not in the request and not in how the request is sent.
The consequence is the point, and we want to state it plainly: MyCliq's servers are not able to assemble a browsing history for you, because there is nothing in the request to attach one to. This is not a setting we promise not to flip. There is no field to flip.
If you tell us MyCliq got a site wrong
You can report a site as wrongly flagged in one step. That report carries the site's name and why MyCliq flagged it — and nothing about you. There is no name field, no contact field, and no way to attach one. A human reads it. It is treated as information, never as an automatic instruction to change the site's status.
What your family sees
Alerts are off unless you turn them on, and turning them on is a separate, deliberate step — not part of installing.
If you turn them on, the people you choose see the name of a website MyCliq paused and when. Please read this part carefully, because it is the sentence with the most consequence in the whole policy: that includes sites connected to accounts you have never shared with anyone. Naming a site can reveal which bank, pharmacy, or service it belongs to.
You control this. You choose who is on the list, you can change it, and you can turn alerts off again. You alone decide whether an alert names a site or describes it more generally.
| They see | They do not see |
|---|---|
| That a pause happened, and when | Your browsing history |
| The name of the paused site (or a description, if that's what you chose) | Anything you typed, on any site |
| Whether you continued or went back | Sites MyCliq did not pause |
The permissions the extension asks for
| Permission | Why |
|---|---|
storage |
To keep the known-good site list, and your interruption settings, on your own computer. This is what lets most checks happen without anything leaving your machine. |
| Access to websites you visit | To read the name of the site you're on and, when a site is risky, to draw MyCliq's pause screen over it. The extension reads the address. It does not read the page's contents, and it does not send the page anywhere. |
How long things are kept
| What | How long |
|---|---|
| A record that a site was checked from the extension | 90 days, then deleted |
| What your family can see in their feed | A rolling 30 days |
| A site your family approved for you | 90 days, then it expires |
| Sites you allowed yourself | Until you change them |
Your choices
- Turn alerts off at any time, from MyCliq's own settings. It takes effect immediately, and the people who were receiving them are told that they stopped — nobody is left believing they are still watching over you when they aren't.
- Allow a site yourself. If MyCliq pauses a site you know and use, you can allow it — on your own, without asking anyone.
- Turn MyCliq off, or remove it. Uninstalling removes the local list from your computer.
- Ask what we hold. Email privacy@mycliq.io and we’ll respond within 30 days.
Contact
Privacy questions: privacy@mycliq.io.