Privacy Policy

Effective date: 23 August 2026

Osprey: Browser Protection is operated by Osprey Project LLC, a California limited liability company ("we", "us", or "our"), which is the data controller for the data described here. This policy covers the Osprey website at osprey.ac, including the website safety checker at osprey.ac/check, the Osprey browser extension, and the proxy server at api.osprey.ac, hosted in New York, NY.

How URL checking works

When you navigate to a website, the browser extension sends the URL to the proxy server, which checks it against threat intelligence providers, DNS filtering services, and local threat intelligence lists.

Providers never see which websites you visit. All checks are routed through the proxy server, so providers only see requests from the proxy's IP address, not yours, and many users' checks are mixed together. Recently checked URLs are served from the proxy's cache without contacting any provider.

When a URL does reach a provider, the data sent depends on the provider type:

• DNS-based providers receive only the hostname, never the full URL or path
• API-based providers receive the URL with query parameters stripped, except for a small fixed set of parameters on specific file-sharing and redirect links that identify the resource being checked rather than you (for example the file ID in a Google Drive download link)
• Local threat intelligence lists are checked on the proxy server with no external calls

Browser permissions

The extension requires the following permissions, used strictly for its security features:

• tabs: Detects tab navigation events.
• webNavigation: Observes navigation events so that destination URLs can be checked.
• storage: Caches results locally and persists your settings.
• https://api.osprey.ac/*: Allows the extension to send URLs to the Osprey proxy server for checking.
• https://api.metadefender.com/*: Allows the extension to contact the MetaDefender API directly, only when you configure your own MetaDefender API key.

The extension does not request host access to the websites you browse and cannot read page content, inject scripts, or access cookies or form data. It sees only the destination URL of each navigation.

Data stored locally

The extension stores the following data in your browser's storage:

• Allowed cache: URLs checked and found safe, stored per provider with an expiration time.
• Blocked cache: URLs that were flagged, stored per provider with an expiration time and threat type.
• Processing cache: URLs currently being checked to prevent duplicate requests. Stored in-memory only.
• Your settings: Enabled providers, cache expiration preferences, and other protection settings.

Local data is cleared when you uninstall the extension. None of it is sent to the proxy server or any third party.

Third-party integrations

If you configure a provider with your own API key (for example, MetaDefender), that provider receives requests directly from your device, the protections above do not apply, and the provider's own privacy practices govern.

The website and safety checker page

The website does not require an account and does not use advertising or cross-site tracking cookies. It does use first-party analytics cookies, as described in the Website analytics section below.

The website safety checker page lets you submit a single link to be scanned on demand. The link is sent to the proxy server and checked with the same providers and protections described above. It is not used to build a profile of you and is not sold to any third party.

Scan records and published warning pages

The proxy server keeps a durable record of the aggregate result for each scanned link, with the query string and fragment removed. This record is about the link, not about you: it holds no IP address or other identifier.

When a scanned link is reported as phishing or malicious by one authoritative vendor or by two or more vendors of any kind, we may publish a public warning page for the link's registrable domain (for example osprey.ac/check/example.com/). Paths, query strings, and subdomains are discarded, so a published page never identifies a specific page, account, or resource, and a page is never published for a shared hosting platform on the basis of one of its tenant sites. Clean results and lower-confidence signals are never published. Published pages are listed in the website's sitemap and announced to search engines, and a page is removed when the underlying record no longer meets the publishing threshold.

Contact form

When you submit a contact form on the website, we process your name, email, company (if provided), and message to respond to your inquiry. This data is retained only as long as needed to provide you an answer. We do not use contact form submissions for marketing or any purpose beyond addressing your question.

Website analytics

The website uses Google Analytics to understand aggregate traffic, such as which pages are visited and where visitors arrive from, so we can improve the site. Google Analytics sets first-party cookies and processes your device and usage information, including a truncated form of your IP address, on our behalf as described in the Google Privacy Policy. You can block these cookies in your browser or install the Google Analytics opt-out browser add-on without affecting any feature of the site.

The website also uses Cloudflare Web Analytics to measure aggregate traffic and page performance. Cloudflare's measurement is cookieless: it sets no cookies, stores nothing in your browser, and does not fingerprint your device, and Cloudflare processes the request data on our behalf as described in the Cloudflare Privacy Policy.

We use this data only for aggregate site analytics and performance monitoring. We do not use it for advertising, we do not combine it with any other data about you, and it is never linked to a scanned URL or a contact form submission.

Bot protection (Cloudflare Turnstile)

The website safety checker and contact pages use Cloudflare Turnstile to prevent automated abuse. Cloudflare processes certain browser and device information when the page loads and when you submit a link or message, as described in the Cloudflare Turnstile Privacy Addendum.

Your IP address

The proxy server uses your IP address solely for abuse protections such as rate limiting. It is hashed and held in memory, and raw IP addresses are not written to disk in normal operation.

Operational and false-positive monitoring

The proxy server keeps aggregated service metrics (such as request counts and cache rates) for reliability and abuse prevention, not for advertising or profiling. To catch legitimate sites that are mistakenly flagged, it also keeps an in-memory log entry when a provider returns a malicious or phishing verdict, recording only the provider, the verdict, and the hostname or query-stripped URL that was checked. Safe results are never logged, and no entry includes your IP address or any other identifier.

Data retention

Rate-limit state and monitoring log entries exist only in memory and are lost on restart. Aggregated metrics may be retained longer. The scan record store persists and holds only link addresses and their vendor results, with no personal identifiers. Records may be updated on a later scan or removed at our discretion. Search engines notified of a published page may continue to list it until they recrawl and find it removed.

Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top reflects the most recent revision.

Contact

For questions about this document, contact support@osprey.ac or write to: