# Figure Skating PPC Helper — Privacy Policy

_Last updated: 2026-05-17_
_Applies to: extension version 1.2.0 and later_

This Chrome extension is designed to help figure skaters, coaches, and parents
fill out Planned Program Content (PPC) forms on the US Figure Skating Event
Management System (EMS) Skater Portal. We have written this policy to be as
direct as possible: what is stored, where it is stored, what leaves your device,
and how to get rid of it.

## 1. Data we store locally on your device

The extension stores the following entirely in your browser using Chrome's
`chrome.storage.local` API. Nothing in this list ever leaves your computer
through any code we control:

- **Your saved PPC programs** — the event name, segment name, and the list of
  element codes you have extracted, edited, or created.
- **Your settings** — fill delay, debug-panel preferences.
- **A cached license flag** — a boolean indicating whether your install has a
  PRO subscription, plus the expiration date and the timestamp of when we last
  verified it with ExtensionPay.
- **A migration audit log and rolling snapshot backups** — up to 3 previous
  snapshots of your storage, kept so a buggy upgrade can be rolled back
  without losing your programs. These also live in `chrome.storage.local`.

This data is never transmitted to any server we operate. We do not operate any
server.

When you uninstall the extension, Chrome wipes its `chrome.storage.local` and
all of the data listed above is permanently gone from your device. Use the
extension's **Settings → Export All Programs** feature first if you want to
keep a copy.

## 2. Data handled by ExtensionPay (third party)

PRO licensing is provided by **ExtensionPay** (https://extensionpay.com). The
extension bundles ExtensionPay's open-source client SDK (`ExtPay.js`), which
makes the following network calls on your behalf:

- When you install the extension and when Chrome starts the extension's
  service worker, the SDK requests your license status from
  `extensionpay.com`. ExtensionPay receives your IP address and an
  ExtensionPay-issued API key that identifies the install.
- When you click **Upgrade**, you are taken to ExtensionPay's checkout page.
  Payment details (card number, billing address, etc.) are entered directly on
  ExtensionPay's site and handled by their payment processor. We never see or
  store any payment information.
- ExtensionPay's SDK caches an install identifier in `chrome.storage.sync` —
  which Chrome may roam across browser profiles that share your Google account.
  This is ExtensionPay's behavior, not ours; it is documented here so you can
  make an informed decision about installing the extension.

ExtensionPay's full privacy policy is available at
https://extensionpay.com/privacy. We do not control ExtensionPay's data
practices and you should review their policy if you intend to upgrade.

## 3. What we do NOT collect or transmit

- We do **not** collect personally identifiable information (no name, no email
  address, no IP logging done by us).
- We do **not** track your browsing activity, page views, or clicks.
- We do **not** include any analytics SDK, telemetry beacon, error-reporting
  service, advertising network, or fingerprinting library.
- We do **not** read or transmit the content of US Figure Skating pages
  except to copy your own PPC element list into local storage when you
  explicitly click Extract.
- We do **not** sell, share, or transfer any user data to third parties for any
  purpose, with the sole exception of the license-verification calls to
  ExtensionPay described above.

## 4. Permissions and why we ask for them

The extension requests the following Chrome permissions, and each one is
necessary for a specific feature:

- `activeTab` — read the URL of the tab you have open when you click the
  extension icon, so we can verify it is the Music & PPC page before
  injecting any code.
- `scripting` — inject the extract / fill / edit scripts only into the active
  tab, and only when you click the corresponding button.
- `storage` — store your saved programs, settings, and the cached license flag.
- Host access to `m.usfigureskating.org/competition/music-and-ppc/*` and
  `www.usfigureskating.org/competition/music-and-ppc/*` — the only URLs the
  extension reads from or writes to.
- Host access to `extensionpay.com/*` — required by the ExtensionPay SDK to
  verify your license and detect successful checkouts.

The extension does **not** request `<all_urls>`, `tabs`, `webRequest`,
`cookies`, `nativeMessaging`, `clipboardRead`, or any other broad permission.

## 5. Open-source attribution

The extension's source code is publicly available. The vendored
`ExtensionPay` SDK is licensed under **AGPL-3.0**; per AGPL's
requirements, anyone who installs this extension is entitled to the
corresponding source. The integrity hash and upstream provenance of the
vendored copy are recorded in `ExtPay.VENDORED.md` in the source repository.

## 6. Your rights

- **Export your data**: open the extension popup → Settings → Backup &
  Restore → Export All Programs. This produces a JSON file you can save.
- **Delete your data**: uninstall the extension, or open the popup →
  Manage → Clear All Data.
- **Contact us**: email amtyurin@gmail.com with questions, deletion requests,
  or to report a privacy concern. We aim to respond within 7 business days.

## 7. Changes to this policy

If we change what data is stored or how it is used, the version number at the
top of this document will be bumped and the change will be noted in the
extension's release notes. Material changes will be announced via the Chrome
Web Store listing.

## 8. Jurisdiction

The extension is published from the United States. Where regional law (GDPR,
CCPA, etc.) grants additional rights, we honor those rights — but because we
hold no personal data we operate, most regulator-defined data-subject requests
have no records to fulfill. If you need a formal confirmation of "no data
held," email amtyurin@gmail.com.

---

Contact: **amtyurin@gmail.com**