Privacy policy: cocloc Free browser extension

The short version

cocloc Free is a browser extension for Chrome, Edge and Firefox that blocks adult websites. It does not collect, store or send your browsing history, the sites you visit, or anything about you. It has no account, no analytics, no advertising and no third party services. It is free software under the GNU General Public License v3.0.

To do its job it runs a small script in the pages you open, which looks only at the addresses of pictures, videos, frames and other embedded media, and on Reddit at Reddit’s own adult content markers. What it sees stays in your browser. Its one network request goes to Reddit, about a Reddit community you have open (see Reddit).

This page covers the extension only. The cocloc app for PC, its browser companion and this website are covered by the main privacy policy. cocloc and cocloc Free are made by After Hours Technologies LLC, a California limited liability company.

How blocking works

The list of blocked domains ships inside the extension. Blocking is done by the browser's own built in rules (declarativeNetRequest): the browser applies them itself, and the extension is not told which requests they match. The extension never downloads the list; a new list reaches you only as a new version from the extension store.

The block page

When the browser has blocked a page load, it reports the failed load to the extension (the webNavigation permission). The extension reads the site's name from that report only to show the cocloc block page with the name on it. Its code listens only for failed page loads, acts only on the browser's “blocked by an extension” error in the main frame, and ignores everything else. The site's name is not stored and not sent anywhere.

The page says why the site was blocked: it is on cocloc’s list, it is a site you added to your own list, its name contains a word on the keyword list you switched on (see below), or Reddit marks the community NSFW (see Reddit). For your own sites and keywords the extension can also tell from the site’s name and your settings, on your device, when the browser does not say which rule blocked the page (Firefox does not).

At install, Chrome asks for this permission under its warning for the access to every site described under Covers inside pages: “Read and change all your data on all websites”. Edge and Firefox use their own words for the same access. The extension does not keep or send a history. It also asks the browser which rule blocked the page (the declarativeNetRequestFeedback permission, covered by the same warning), and shows the cocloc page only when one of cocloc’s own rules did it. A page blocked by another extension keeps the browser’s own error. Firefox does not say which rule blocked a page, so there a blocked page that is not one of your own sites or keywords gets a neutral “This page was blocked” page, which does not say it is an adult site.

Covers inside pages

When a page you open shows a picture, video or frame from a blocked site, the browser refuses to load it and the page is left with a broken picture. The extension draws a plain cocloc cover over that spot instead. Any site can show pictures from a blocked site, so this has to work on every site: the extension has access to all sites from install, and runs a small script in every page and every frame in it.

That script looks at addresses only: the addresses of frames and embedded objects, of pictures a page sets as an inline background, and of pictures, videos, sounds, frames and other embedded media that failed to load. For each one it asks the extension’s own background script whether the site’s name is on cocloc’s list, on your own list, or on neither, and gets one of those three answers. The list is checked on your device, against a copy that ships inside the extension. To place a cover, the script also reads where the element sits on the page and how big it is.

It does not read the page’s text, your searches, form fields or anything you type, and it does not keep a history. Nothing it sees is stored, and nothing leaves the browser: the site names go only to the extension’s own background script. The cover is drawn inside the page in a closed box, so the page cannot read its words.

Reddit marks its own adult communities and posts as NSFW. On reddit.com a second script reads those markers in the page.

A post Reddit marks NSFW, in a feed, in search or on its own page: its pictures and videos get the cocloc cover, and its videos are muted and paused. Its text and comments stay readable.
A community Reddit marks NSFW is treated as a blocked site. The tab goes to the cocloc block page (in an Incognito window in Chrome and Edge, to the browser’s own blocked page), and the extension blocks that community for the rest of the browser session (see What is stored).
The one network request. On old.reddit.com the page does not carry a marker the extension can read for the community. So when you open a community there, the extension asks Reddit for that community’s own “about” data (old.reddit.com/r/<name>/about.json), at most once per community while that page is open. The request goes to Reddit from the page you have open, the way the page’s own requests do, with your Reddit sign in if you have one. Its address carries the community’s name, which Reddit already has from the page you opened. The extension reads only Reddit’s over 18 flag from the answer and keeps nothing. Nothing goes to cocloc.

What is stored

Four things, all in the browser's local extension storage (the storage permission), on this device only. They are not synced and not sent, and they are deleted when you remove the extension.

A count of pages blocked so far, so the toolbar popup can show it.
The sites you add to your own block list, if you add any (see Your own blocked sites).
Whether keyword blocking is on.
Whether safe search is on.

While the browser is open, the extension also keeps the names of the Reddit communities it blocked (see Reddit), as block rules in the browser’s memory, at most 500. They are gone when the browser closes.

Settings and the welcome page

When the extension is first installed, it opens a welcome page in a new tab (once: not on updates or browser restarts). It covers letting the extension run in Incognito (private) windows, safe search and keyword blocking, and what cocloc for PC adds. While you are looking at it, the welcome page checks every 2 seconds whether Incognito is allowed and shows On or Off. In Chrome and Edge its “Open extension settings” button opens the extension’s page in the browser’s settings, where the switch is; Firefox names the setting instead. Safe search and keyword blocking stay off until you switch them on.

The same settings, plus your own block list and a “Suggest unblocking” field, are on the Settings page, opened from the popup’s “Settings” link or from the extension’s details in the browser.

Your own blocked sites

You can add sites to block, on the Settings page or with “Block a site” in the popup. What you type is reduced to the site’s name (for example https://www.example.com/page becomes example.com). A site you add is blocked like the ones on cocloc’s list, with its subdomains, and shows the cocloc page, which says you added it and links to Settings to remove it. The extension refuses numeric addresses, cocloc.com, the extension stores and the domains they sit under (google.com, microsoft.com, mozilla.org), so you cannot lock yourself out of managing or removing it.

The list stays on this device, in local extension storage. It is not synced and not sent.

Keyword blocking

Optional and off until you switch it on. When it is on, the browser also blocks pages and frames whose site name contains one of twelve words that are common in the names of porn sites. The words are listed in the extension itself rather than here. Only the site’s name is checked, not the rest of the address, so searches and articles that mention these words still open. The words appear in about 21% of the domains on cocloc’s list; they are there to catch new sites the list does not have yet.

Never blocked by keyword, with all their subdomains: the health, recovery and education sites cocloc never blocks (such as wikipedia.org, nih.gov, nofap.com and fightthenewdrug.org), cocloc.com and the extension stores, and seven recovery sites whose names happen to contain one of the words, such as nofap.com (the full list is in the extension itself).

A word can sit inside an ordinary site’s name, so keyword blocking can block a site it should not. Switch it off in Settings if that happens. Some short words are left out on purpose because they sit inside ordinary names, such as Essex, camera, canteen and analytics.

The browser applies the keyword rule itself. The extension does not see the pages you open.

Safe search

Optional and off until you switch it on. When it is on, the browser changes your own requests to these sites:

Google searches (www.google.com, .co.uk, .ca, .com.au, .de, .fr, .es, .it, .nl, .co.in, .com.br) get safe=active.
Bing searches (www.bing.com) get adlt=strict.
DuckDuckGo searches (duckduckgo.com) get kp=1.
Requests to YouTube (www.youtube.com, m.youtube.com, www.youtube-nocookie.com, youtubei.googleapis.com) carry the header YouTube-Restrict: Strict, which turns on YouTube’s Restricted Mode.

Your search keeps its words and other settings; a safe=off is replaced. The browser makes these changes with its built-in rules. The extension does not read the pages or your searches.

To make these changes the extension needs access to those sites. It normally has it already, from the access to all sites it is given at install, and then nothing is asked. If you limited the extension’s site access in the browser’s settings, the browser asks you for these sites when you switch safe search on. Chrome says “Read and change your data on a number of websites” and Edge says “Read and modify your data on a number of websites”, with the list of sites; Firefox shows its own prompt for the same sites. Switching safe search off removes the rules, and gives back access that was asked for this way. If you take the access away in the browser’s settings, safe search switches itself off.

The extension sends nothing for this. The search engines and YouTube receive the safe-search setting as part of the searches and requests you make to them.

What is sent

The extension sends nothing to cocloc by itself. Its one network request of its own is the Reddit request described under Reddit, which goes to Reddit.

Three things can open a page on cocloc.com. Each is an ordinary page you see open. Like any web address, the page's address (including the details listed below) reaches cocloc.com's server when it opens; nothing more is sent unless you choose to send it on that page.

“Suggest unblocking”, a link on the block page, and a field on the Settings page and in the popup. Only when you click it, it opens the unblock form in a new tab with the site's name, the word “extension” and the extension's version in the address. For a site you added to your own list it offers to remove it instead, and opens nothing. The request is stored only if you press the button on that form. What the form stores is listed under “Unblock requests” in the main privacy policy.
The links to cocloc for PC on the block page, in the popup and on the welcome page. They open cocloc.com with a tag saying which link you clicked (ref=ext-block or ref=ext-popup; on the welcome page utm_source=extension&utm_medium=welcome, plus utm_campaign=install on the main button) and nothing else. The “Privacy” links on the welcome and Settings pages open this page and carry nothing.
The exit question. When you remove the extension, the browser opens one optional question at cocloc.com/goodbye. Its address carries only the product (“extension”) and the extension's version. An answer is sent only if you give one and press Send. What an answer stores is listed under “Exit survey” in the main privacy policy.

Pages on cocloc.com are served by Cloudflare, which keeps standard server logs as part of serving any website.

Permissions

declarativeNetRequest: lets the browser block the listed domains, your own sites and (if you switch it on) keyword matches with its built in rules, and apply the safe search rules. It also holds the session rules for Reddit communities Reddit marks NSFW (see Reddit).
webNavigation: tells the extension when the browser has blocked a page load, so it can show the cocloc block page instead of an error.
declarativeNetRequestFeedback: lets the extension check that it was cocloc’s own rule that blocked a page, so blocks by other extensions are never labelled as cocloc blocks.
storage: keeps the count of blocked pages and your settings on this device.
Access to all sites (host_permissions, every http and https site), asked at install: lets the cover script run in every page and frame, and the Reddit script on reddit.com (see Covers inside pages and Reddit). It also covers the safe search sites, so switching safe search on normally asks nothing.
Optional access to the safe search sites (optional_host_permissions): requested when you switch safe search on; the browser asks you only if you limited the extension’s site access. Used only for the safe search rules above.

The extension has two content scripts, both listed in its manifest: the cover script, on every page and frame, and the Reddit script, on reddit.com. They read only what the sections above describe. The Settings page (options_ui) is not a permission and adds no warning.

Never blocked

cocloc.com and the extension stores are never blocked, by the list, by your own list or by keyword blocking, so you can always manage or remove the extension.

Data sale and sharing

The extension collects no user data, so there is nothing to sell, share or transfer. We do not use or transfer data for purposes unrelated to the extension's single purpose, and we do not use it to determine creditworthiness or for lending.

The use of information received by the cocloc extensions adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Source code

cocloc Free is free software under the GNU General Public License v3.0. The domain list is merged from public blocklists, each under its own licence, listed in the extension's NOTICE.md. The public source repository will be linked here when it is published.

Changes

If a new version changes what the extension stores, sends or opens, this page will say so before that version is published.

Contact

After Hours Technologies LLC, maker of cocloc
[email protected]

cocloc Free for your browser.