# Privacy Policy — Hiṣn (حصن)

**Effective Date:** June 2026  
**Last Updated:** June 2026

---

## Overview

Hiṣn ("حصن", meaning "fortress") is a browser extension that protects users from phishing, typosquatting, and malicious websites targeting Saudi Arabian government services, financial institutions, and telecommunications providers.

This privacy policy explains what data Hiṣn collects, how it is used, and your rights regarding that data.

---

## Data Collection

**Hiṣn collects no personal data.**

Specifically:

- **No URLs are transmitted.** All URL analysis is performed locally on your device using a built-in threat detection engine. No URL, domain name, or browsing history is ever sent to any server.
- **No browsing history is collected.** Hiṣn does not record, store, or transmit any information about the websites you visit.
- **No user identifiers are created.** Hiṣn does not generate, store, or transmit any user IDs, device IDs, session IDs, or tracking identifiers.
- **No analytics or telemetry are collected.** Hiṣn does not use Google Analytics, Firebase, or any other analytics service.
- **No cookies are set.** Hiṣn does not create or read any browser cookies.
- **No third-party services are used.** Hiṣn makes zero network requests during operation. The extension functions entirely offline.

---

## Local Storage

Hiṣn stores the following data locally on your device using Chrome's `chrome.storage.local` API. This data never leaves your device.

| Data | Purpose | Format |
|---|---|---|
| Shield enabled/disabled state | Remembers whether you have turned protection on or off | Boolean (`true`/`false`) |
| Blocked event counter | Displays the total number of threats blocked in the popup | Integer |
| Recent blocked events (last 100) | Displays recent threat activity in the extension popup | Array of objects containing: domain name, threat category, score, and timestamp |

**None of this data contains personally identifiable information.** The blocked events record which domains were blocked, not which user was browsing or what content was on the page.

---

## Data Sharing

Hiṣn shares no data with any third party. There is no data to share.

- No data is sold.
- No data is shared with advertisers.
- No data is shared with analytics providers.
- No data is shared with parent companies, subsidiaries, or affiliates.

---

## Permissions

Hiṣn requests the following Chrome permissions:

| Permission | Why It Is Needed |
|---|---|
| `webNavigation` | Required to check URLs before pages load. This is the core security function — Hiṣn intercepts navigation events to analyze the destination URL against the threat detection engine. |
| `storage` | Required to save your preferences (shield on/off) and the count of blocked threats across browser sessions. |
| Host permission (`<all_urls>`) | Required to analyze URLs on all websites. A security extension that only works on some domains cannot effectively protect users from phishing. No data from these URLs is transmitted. |

---

## Data Security

All threat analysis is performed using a local engine embedded within the extension. The engine:

- Contains zero network code (no `fetch()`, no `XMLHttpRequest`, no WebSocket)
- Has zero runtime dependencies on external packages
- Runs within Chrome's Manifest V3 extension sandbox
- Cannot access the file system, clipboard, or other browser extensions

---

## Children's Privacy

Hiṣn does not knowingly collect any data from children under 13 (or under 16 in jurisdictions where applicable). Since Hiṣn collects no personal data from any user, this concern is addressed by design.

---

## Changes to This Policy

If this privacy policy changes, the updated version will be posted at this URL with a new "Last Updated" date. Since Hiṣn collects no data, material changes to this policy are unlikely.

---

## Your Rights

Under the Saudi Personal Data Protection Law (PDPL) and other applicable data protection regulations, you have the right to:

- Know what personal data is collected about you: **None.**
- Request deletion of your personal data: **No personal data exists to delete.** You can clear all local extension data by removing the extension from Chrome.
- Object to data processing: **No data processing occurs.**

---

## Contact

For questions about this privacy policy or the Hiṣn extension:

- **Email:** hisn.security@gmail.com
- **Website:** https://github.com/hisnsecurity-commits/hisn-security

---

*Hiṣn is built in Saudi Arabia for Saudi Arabia. Your browsing data stays on your device. Always.*