RiskCard / Privacy

Privacy Policy

Last updated: November 6, 2026 (America/New_York)

RiskCard is operated by Josh D’Alessio (Joshua B. D’Alessio). This policy covers the public RiskCard website (including its web lookup) and the v0 Chrome extension, which is not yet published on the Chrome Web Store.

What the extension processes

When you choose to analyze a Google Play listing, RiskCard reads the listing’s visible public text to build a privacy risk card. Processing happens in your browser. The extension has no RiskCard backend, uses no paid API, and does not upload listing contents to a RiskCard server.

Local storage and free quota

The extension stores a date and daily-use count in chrome.storage.local to track its free quota of five cards per calendar day. No account is required for v0. You can remove this locally stored extension data by uninstalling the extension.

The v0 extension does not create user accounts, sell data, or run analytics SDKs.

Extension permissions

• storage — stores the daily free-use counter.
• activeTab — responds to the popup’s “Make card” action on the current tab.
• Host access to https://play.google.com/* — adds the RiskCard button and reads the listing page you opened.

The website lookup

When you use the lookup on riskcard.app, the app link or package id you enter is sent to our server (a Cloudflare Worker). The server requests that app’s public Google Play Data Safety page and public permissions list from Google and returns a card. We do not ask for your name, email, or an account.

To enforce the free limit of five cards per day, the server keeps a short-lived, in-memory count tied to your IP address and the date. It is not written to a database and is discarded when the server instance restarts. Lookup results for an app (public listing data only, not information about you) may be cached for up to six hours. Cloudflare, our hosting provider, processes ordinary request logs to deliver and protect the service.

The public website

This website contains no advertising, analytics scripts, or account forms. Its pages do not set application cookies or use browser local storage. The hosting provider processes ordinary connection information, such as an IP address and request details, to deliver and protect the website. The extension’s processing, described above, happens locally.

Contacting us

If you email us, the information you include is handled through email services so we can respond. Please do not send sensitive personal information or private app data.

Third parties

Google Play is operated by Google. Your use of Google Play is governed by Google’s terms and privacy policy. RiskCard does not control Google’s servers. Any summary you choose to share is also subject to the practices of the service you share it through.

Children

RiskCard is not directed at children under 13.

Changes

This policy will be updated before features such as accounts or an external AI API ship, including an explanation of any information that would leave your device.

Contact

For privacy questions, contact Josh D’Alessio at info@riskcard.app.