Your privacy

Nothing is analysed in your browser. When you press Check this, what you submitted is sent over an encrypted connection to the NextAct server, analysed there, and stored in NextAct’s database, which our hosting providers run for us. Your checks are linked to this browser by a cookie, not to an account.

A check is made of four different things, kept for different lengths of time:

• What you submitted — the text, link or file.
• What NextAct extracted — addresses, masked payment details and the phrases its checks matched.
• The result — the assessment, the reasons, the unknowns and the evidence summary.
• A shared summary, only if you make one — a separate page with the decision and none of what you submitted, until it expires or you revoke it.

Reading the wording, examining a link’s structure, decoding a QR code, extracting text from a PDF, Word document or an email, comparing claims with evidence and producing the assessment all happen inside NextAct. No page is fetched, no link is followed and no attachment is opened.

Link reputation uses a public bulk feed downloaded from phishunt, and optionally PhishTank when configured. NextAct compares up to 20 distinct supported extracted addresses locally on its server. Additional links beyond that budget are not covered. Your address, message and files are not sent to either feed operator. A feed listing is evidence with limited coverage, not a guarantee about a link.

The additional checks on a link contact outside services, and send the minimum each protocol needs:

• the hostname, to a DNS resolver;
• the registrable domain (example.com, never a full address), to that domain’s registry;
• a connection to the site’s server to read its certificate — no page is requested.

Never sent: the message text, email bodies, uploaded files, the path or query of a link, your identity, your session or the check’s identifier. Checking a link does tell that domain’s infrastructure that someone asked about it; it does not tell them who you are or what you were asked to do.

You choose at submission. Keep it in my history marks the check for deletion after 90 days so you can return to it during that window. Automatic history deletion is enabled in this deployment. It runs on a schedule, so removal can follow the expiry date; configuration alone does not prove that every run succeeded. Delete the original once checked keeps the result and the evidence summary and removes what you submitted as soon as the analysis is stored — including the spans of it quoted into summaries, the path and query of any link, and any value an automated reading proposed.

Deleting a check removes the case and everything derived from it: the material, extracted values, entities, claims, evidence, signals, assessments, policy records and any AI records. The confirmation page counts exactly what will go. There is no “deleted” flag on a row that stays.

NextAct schedules an encrypted backup of its application database each day, with a restore check before upload to a private GitHub repository's Actions artifacts. Those artifacts expire after 35 days. Deleting a check from the active database does not erase it from an existing backup before that backup expires. The database provider may keep its own copies for disaster recovery under its terms; NextAct has not verified how long.

Your checks

NextAct sets cookies that make the site work, and no others. There is no advertising or analytics cookie, and none is shared with anyone.

• Your session — an opaque identifier that links your checks to this browser. It holds nothing about you, and clearing it detaches this browser from its checks.
• Your language (nextact_locale) — only if you choose one.
• Signing in to NextAct Business — sign-in and two-factor cookies, used only by people who sign in there. While you sign in with Google, one more short-lived cookie ties your return from Google to this browser; it is used once.

Checking a message never needs an account. NextAct Business does: sign-in proves control of an email address or a Google identity. Public Google registration is available where offered; joining an existing organisation still requires an invitation.

• By emailed link — you type your work email address; NextAct sends a single-use link and keeps the address, that it was confirmed, and a record of your sessions (without your IP address or browser details).
• With Google, where offered — NextAct asks Google to confirm your email address and asks for nothing else (the “openid” and “email” permissions). It receives Google’s identifier for your account, your email address, and Google’s statement that it has verified that address. It does not ask for your name, picture, contacts, mail, files or calendar, and it does not keep the access Google grants for the sign-in, so it cannot read anything from your Google account afterwards. Google learns that you signed in to NextAct.
• Signing in does not add you to an existing organisation; that needs an invitation. You can create your own workspace. A verified Gmail or Google Workspace identity can sign directly into the same verified NextAct email account. Other matching-address cases need a recent sign-in before connecting Google from Account security.
• A new Google account using a third-party email address may have Google as its only sign-in method. That address does not enable email recovery. You can disconnect Google from Account security when your account has a verified email recovery method. Deleting your account deletes the connection with it.

On supported devices, an installed NextAct can receive a message or a file from the Share menu. When its service worker handles the share, it stays in this browser until the check form reads it. Each share has its own handoff and is removed when read; it is not checked until you press Check.

Unread handoffs stop opening after ten minutes. Expired copies are removed on the next service-worker activation or share. Closing the browser can leave that copy on your device until then; this is not a guarantee of deletion from disk after ten minutes.

If the service worker is unavailable, your browser may send the shared content to the fallback server route. That route redirects to the check form without reading or analysing the body; the request can still reach the hosting infrastructure. Paste the message into the form to continue.

• It does not link your checks to anyone else’s, and no relationship crosses a case.
• It does not sell or share what you submit, and no analytics vendor receives it.
• Checking a message does not need an account, an email address or a phone number.
• It does not store card numbers in full, and one-time codes are never stored at all.

The NextAct extension for Chrome and Edge has one purpose: to let you ask NextAct to check the page, the text or the part of the screen you choose, and to show you the result. It has no script that runs inside web pages. It does not watch your browsing, and it cannot read page content, form fields, cookies, your history or your other tabs.

What it can access — only after you act

• The current tab’s address, when you open NextAct from the toolbar or choose “Check this page with NextAct…”. Your browser then lets the extension read that one tab’s address so the popup can show it to you. Showing it sends nothing.
• The text you selected, when you choose “Check selected text with NextAct”. Your browser passes the selection to the extension as plain text.
• A picture of the visible part of the tab, only when you press “Check what is visible”.

What is sent to NextAct, and why

Each check sends exactly one of these to NextAct’s server at nextact.tech:

• the page address, after you press “Check this page”. Any name or password written before an “@” and everything after “#” are removed first. The rest is sent, including the path and anything after “?” (the popup tells you when there is such a part);
• the selected text, when you choose the menu item — up to 20,000 characters. A longer selection is refused in your browser, and nothing is sent;
• the picture, as one JPEG image, after you press “Check what is visible”.

This is needed because the check itself runs on NextAct’s server: nothing is analysed in your browser. Each request also carries the extension’s installation credential (below) and a random identifier for that check, so that a retry does not create a second one. Requests are sent without your cookies, without your NextAct website session and without the address of the page you came from.

How a check is processed

By the same checks as the website, on NextAct’s own server. For extension checks, no AI or language-model service is used, whatever the website’s AI setting; no domain-name, registration or certificate lookup is made; and the page is not fetched. A picture is examined on NextAct’s server — any QR code in it, and its text where this deployment has text reading switched on. No outside service sees what you sent.

What stays in your browser

• In the extension’s own storage, which web pages cannot read: the installation credential — a random 43-character value — and nothing else.
• In memory only, cleared when the browser closes: the current check’s identifier, whether it was a page, text or a picture, whether it is running, finished or could not be completed, and why not (for a selection that was too long, only its length).
• The address, the text and the picture are held only while they are being sent. The extension keeps no browsing history and no preferences, and contains no analytics or error-reporting service.

The installation credential

The first check registers the installation. NextAct’s server creates a random credential, returns it once, and stores only a one-way hash of it. The extension sends it only in the authorisation header of its own requests to nextact.tech — never in an address, a cookie or a web page. It identifies an installation, not a person: it is not linked to a NextAct account, to your checks on the website, or to any other installation. A credential unused for 90 days stops working, and the installation is then deleted with every check it made (below); the extension registers a new one on its next check.

What NextAct keeps, and for how long

• What you sent — the address’s path and query, the text, and any text read from a picture — is deleted as soon as the result is stored. The picture itself is never written to NextAct’s database; its size, its type and a fingerprint (a SHA-256 hash) are kept with the result.
• The result — the risk level, what to do, the reasons, what could not be verified, and details derived from what you sent, such as the web address’s host and masked payment details — is kept until you delete it with “Delete” in the popup, or delete everything with “Reset NextAct in this browser”, which removes the installation and every check it made.
• Automatically, after 90 days without use. When the extension has not been used for 90 days — for example because you uninstalled it — its credential stops working and NextAct deletes the installation and every check and summary it made, in the same way as a reset. This runs once a day, so it happens within about a day of the 90 days passing. Each time the extension contacts NextAct — a check, or reading a result — restarts the 90 days. To remove your results sooner, use “Delete” or “Reset NextAct in this browser” before uninstalling.
• “See the full summary” creates a separate NextAct page with the decision and none of what you checked. Anyone with its link can open it until it stops working after 24 hours. Deleting the check deletes it.
• Backups are as described in “Deleting is real” above.

Who else is involved

• NextAct runs on Vercel (the application, in its Mumbai region) and Supabase (the PostgreSQL database, in its Mumbai region), which process and store data on NextAct’s behalf. The hosting provider keeps its own short-lived request logs under its terms. No analytics, advertising, AI or data-broker company receives anything the extension sends.
• NextAct’s own logs record events, counts and error types — not what you checked, addresses or credentials.
• To limit abuse, the server keeps a keyed hash of the network address that registered an installation, and of the installation, while a rate limit applies. It does not keep the address itself.
• People do not read what you check, except where it is needed to keep the service secure (for example, investigating abuse), to comply with the law, or with your explicit permission. The person who operates NextAct has administrative access to its hosting and database for those purposes.

Security

Everything the extension sends goes over an encrypted (HTTPS) connection to nextact.tech. The extension has no permission to contact any other site, and its content-security policy blocks connections elsewhere. NextAct’s server reaches its database over an encrypted, certificate-checked connection.

What it is used for

Only to perform the check you asked for and show you its result. What the extension handles is not sold, not used or passed on for advertising, personalisation, profiling, creditworthiness or lending, not used to train any model, and not used for any purpose unrelated to checking what you chose to check.

The use and transfer of information that the NextAct browser extension receives adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. In particular, that information is:

• used only to provide the extension’s single purpose described above;
• transferred only to the hosting and database providers named above, as needed to provide that purpose, or where the law requires it or it is needed to protect against security threats or abuse;
• never sold, and never used or transferred for advertising;
• never used or transferred to determine creditworthiness or for lending, and never used to build a profile of you;
• not read by people, except with your explicit permission, where needed for security purposes such as investigating abuse, or to comply with the law.