ReMOAT Privacy Policy & User Data Protection Statement

1. Identification, Scope & Single Purpose Declaration

This Privacy Policy sets forth the privacy practices and strict user data protections applied by ReMOAT Technologies Private Limited ("ReMOAT", "we", "us", or "our") across all our products and services, including:

• The ReMOAT — Live Remote DevTools Debugger Chrome Extension (Manifest V3, Version 3.2.3+).
• The ReMOAT Developer Portal hosted at portal.remoat.dev and app.remoat.dev.
• The ReMOAT Client SDK (@remoat.dev/sdk and remoat-sdk.js).
• The official documentation and platform website at https://remoat.dev.

Single Purpose Declaration: The single purpose of the ReMOAT Chrome Extension is to enable software engineers, QA professionals, and technical support specialists to perform real-time, peer-to-peer browser debugging, inspection, and live defect reproduction across browsers using encrypted WebRTC DataChannels, eliminating the need for server-side recording or video uploads.

2. Comprehensive User Data Collection & Access Inventory

In adherence to the Google Chrome Web Store User Data Policy and the Principle of Data Minimization, we collect and access only the minimal data elements strictly required to provide the core remote inspection functionality:

What We NEVER Collect:

• NO General Browsing Activity: We never log, track, or monitor URLs, tabs, or web activity outside the single tab you explicitly choose to inspect.
• NO Passive Background Scraping: When the extension is idle or closed, it consumes 0 network bandwidth and transmits 0 data.
• NO Keystroke Logging: Key inputs are not recorded or logged outside active live debugging sessions.
• NO Personal Cloud Storage: We never upload user session videos, screenshots, or DOM databases to cloud storage clusters.

3. How We Collect User Data (Collection Mechanisms)

Data collection occurs exclusively via direct, voluntary user action:

1. Explicit User Initiation: The extension is dormant until you open the popup and click "⚡ Start Live Debugging", or right-click a web page and select "⚡ Inspect with ReMOAT".
2. PIN / API Key Authorization: Live session pairing requires providing your Workspace API Key or entering a 6-digit cryptographic session PIN.
3. Transparent Tab Injection: The telemetry script (remoat-sdk.js) is injected into the inspected tab only after you trigger the session via chrome.scripting.executeScript.

4. How We Use User Data (Purposes of Processing)

All collected information is processed solely to operate, maintain, and deliver the remote debugging features requested by the user:

• To establish direct WebRTC peer connections between the inspected browser and the developer workstation.
• To stream live console outputs, error traces, and network requests into the Chrome DevTools replica interface for troubleshooting.
• To replicate DOM mutations and display visual remote pointers during pair debugging sessions.
• To validate that an API key is active and belongs to an authorized developer workspace.
• To display connection alerts via chrome.notifications when remote peers connect or disconnect.

Strict Prohibition on Secondary Uses: ReMOAT Technologies Private Limited strictly guarantees that user data is NEVER used for advertising, marketing, profiling, interest-based tracking, credit evaluation, automated decision-making, or commercial resale.

5. Data Handling, Storage & Zero Cloud Retention Architecture

ReMOAT was architected specifically to eliminate data retention liabilities for engineering teams working in regulated environments (healthcare, fintech, e-commerce):

• WebRTC DTLS 1.3 Encryption: All live telemetry packets flow directly between the target browser and developer workstation through WebRTC DataChannels secured by Datagram Transport Layer Security (DTLS 1.3) and AES-GCM-256 ciphers.
• Zero Server Data Storage: No ReMOAT server or broker records, persists, or caches live DOM trees, console logs, network payloads, or user interaction streams. Once a session is closed, the data is gone forever.
• Local Sandbox Isolation: The extension stores API keys strictly within the browser's protected local storage (chrome.storage.local). This data is never sent to cloud databases unless authenticating an active session.
• Ephemeral Signaling: Signaling servers only forward SDP session offers/answers and ICE candidates to facilitate peer discovery. These tokens are held in volatile RAM only for the seconds required to establish the P2P channel and are immediately discarded.

6. Comprehensive Disclosure of ALL Third Parties User Data is Shared With

In strict compliance with Chrome Web Store policies, we explicitly disclose all parties that receive or process user data in connection with our services:

Absolute No-Sale Guarantee: ReMOAT Technologies Private Limited does NOT sell, rent, license, trade, disclose, or transfer any user data, personal information, or telemetry to third-party data brokers, ad networks, or analytics aggregators under any circumstances.

7. Data Retention, Deletion & Purge Guarantees

• Live Telemetry: Retained for 0 seconds. Once the WebRTC data channel closes or the user closes the browser tab, all telemetry ceases and is purged from RAM.
• Signaling Metadata: Ephemeral SDP session descriptions and ICE candidate records are automatically deleted from server memory within 60 seconds.
• Local Extension Storage: Retained on the user's computer until the user clicks "Clear" in the extension popup, deletes browser site data, or uninstalls the extension.
• Developer Account Data: Maintained while your workspace account is in good standing. You can request permanent account and data deletion at any time by emailing privacy@remoat.dev; all records will be irrevocably purged within 30 days.

8. Full Chrome Extension Permissions Audit & Narrow Scope

The ReMOAT Chrome Extension requests access to the narrowest permissions strictly necessary to implement its features:

Audited Removal of Unused Permissions: The ReMOAT Chrome Extension (Version 3.2.3) does NOT request, attach, or use the debugger permission. All live telemetry is captured via non-invasive DOM/network event interception and WebRTC DataChannels.

9. Client-Side Sensitive Data Redaction & PII Masking

To prevent accidental transmission of sensitive data during live debugging sessions, the ReMOAT client library applies automatic client-side redaction prior to packet dispatch:

• Password Fields: Inputs with type="password" are automatically masked with asterisks (••••••••).
• Credit Card Numbers: Form fields with autocomplete="cc-number" or matching standard credit card Luhn algorithms are sanitized locally.
• Custom Redaction Tags: Any HTML element containing the attribute data-remoat-ignore or data-remoat-mask is stripped of its text content and attributes before DOM serialization.
• Authorization Headers: Sensitive HTTP request headers (Authorization, Cookie, X-Api-Key) are masked by default in network inspection waterfalls.

10. User Rights under GDPR, CCPA/CPRA & India DPDP Act 2023

Depending on your jurisdiction, you possess explicit statutory rights regarding your personal information:

• Right of Access & Portability: You may request a machine-readable copy of any account data we hold regarding your developer profile.
• Right to Rectification: You may correct inaccurate profile or workspace information via the Developer Portal.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and all associated configuration records.
• Right to Withdraw Consent: You may revoke permission for local storage by clearing your API key in the extension popup.
• Grievance Redressal (India DPDP Act 2023): Indian data principals may submit complaints directly to our designated Grievance Officer, with guaranteed acknowledgment within 24 hours and resolution within 30 days.

11. Children's Privacy & Security Controls

ReMOAT products are intended strictly for professional web developers, software engineering teams, and enterprise quality assurance personnel. We do not knowingly solicit or collect personal information from children under the age of 16. If we become aware that a child has provided us with personal data, we will immediately delete such information.

12. Contact Information & Data Protection Officer