Clikso Browser Extension Privacy Policy

Effective Date: September 10, 2026

This policy covers the Clikso browser extension only. It explains what the extension stores on your device, what it sends to Clikso, and what it never collects.

The Clikso website and dashboard are covered by our main Privacy Policy. Where this policy is silent, the main policy applies.

1. Who We Are

The extension is published by Playxoft Studios Private Limited ("we," "us," or "our"), the company behind ClikSo (https://clik.so).

You can reach us at support@clik.so about anything in this policy.

2. What the Extension Is

The extension shortens links with your Clikso account without you opening the dashboard.

You can shorten the page you are on, shorten a link you right-click, or shorten a URL you type after the clik keyword in the address bar. You can also see, search, copy and edit your recent links.

To do this, the extension connects to one or more of your Clikso workspaces. You start that yourself from the extension, and you approve it on a Clikso page while signed in.

3. Data Stored on Your Device

All of this is stored in your browser's local extension storage (chrome.storage.local). None of it is synced to your browser account, and none of it is copied to another device.

Your cached workspace data and your settings stay on your device — we never read them back. The API key is the one exception: it is stored here, and it is also sent to Clikso with every request the extension makes, because that is how the request proves whose account it belongs to. See section 4.

A workspace API key. One key per connected workspace. The key is created by Clikso when you connect, and the extension uses it to prove which account it is acting for. It is sent with each API request.
Cached workspace data. Your domains, folders, tags, recent links, and your plan usage figures. This is a copy of data that already exists in your Clikso account. It is cached so the extension opens instantly instead of waiting for the network.
Your settings. For example: whether new links are copied automatically, whether notifications are shown, your theme, and your default domain and folder per workspace.
The workspace name, your display name, email and profile picture for each connected workspace, so the extension can show you which account is active.

The extension also uses short-lived session storage while you are connecting a workspace, or while a right-click dialog is open. That is cleared when your browser closes.

We never show your full API key in the extension interface, and we never write it to the browser console.

4. Data Sent to Clikso

The extension talks only to the Clikso API at https://app.clik.so. It sends:

The URLs and page titles you choose to shorten. Only the ones you act on — the page you shorten, the link you right-click, a URL you select on a page and then right-click, or the URL you type in the address bar. Nothing is sent because you merely visited a page.
The link settings you enter. Your chosen domain, custom slug, title, folder, tags, and any optional password or expiry date you set.
Search terms you type in the extension, when you search your own existing links.
Your API key on each request, plus the workspace you are acting in and the extension version. The version tells our logs which client made the call.

We handle this data the same way we handle links you create in the dashboard. It is described in our main Privacy Policy.

5. Data We Do NOT Collect

No browsing history. The extension does not read the list of pages you visit. It deliberately does not request the browser tabs permission, which is what would be needed to do that.
No page content. It does not read, scrape, or transmit the text, images, or data on the pages you visit — except the one-time approval value on our own connect page at app.clik.so/extension/connect, which you trigger, and which exists only to hand the extension your key.
No keystrokes. It does not log what you type on web pages.
No form data. It does not read forms, passwords, or payment fields on any site.
No analytics or telemetry in the extension. There is no tracking script, no usage analytics, no crash reporting, and no advertising or fingerprinting code inside the extension.
No third-party sharing. The extension sends data to Clikso and to nobody else. The released extension contacts no server other than app.clik.so.
No selling. We do not sell your data.

6. Browser Permissions and Why Each Is Needed

Browsers ask you to approve permissions when you install an extension. These are the permissions we request, and the exact reason for each.

Permission	Why we need it
`storage`	To save your API key, your settings, and the cached workspace data on your device.
`contextMenus`	To add the "Shorten with Clikso" item to your right-click menu.
`notifications`	To show a small confirmation when a link is created and copied.
`activeTab`	To read the URL and title of the current tab only when you act — clicking the toolbar icon, using the keyboard shortcut, or picking the right-click item. It gives no access to any other tab and no access to your history.
`scripting`	To place the small shortening dialog into the current page after you pick the right-click item. Nothing is injected until you pick that item, and then only into that one tab. It is the only action in the whole extension that injects anything.
`offscreen`	To copy the short link to your clipboard reliably, including when the action starts from a background event such as the right-click menu.
`clipboardWrite`	To put the short link on your clipboard so you can paste it.
Host access to `https://app.clik.so/*`	To call the Clikso API, and to receive your API key from the Clikso connect page when you approve it. This is the only website the extension is allowed to reach.
`omnibox` keyword `clik`	To let you type `clik` in the address bar to shorten a URL or search your links. The extension sees only what you type after the `clik` keyword — not your other address bar activity.

Two more things the extension declares, which browsers do not always show as separate permissions:

A content script on our own connect page. A small script runs on https://app.clik.so/extension/connect and nowhere else. Its only job is to receive the workspace key from that page after you approve the connection. It does not run on any other site, including other pages on app.clik.so.
One page of the extension is reachable from a web page. The shortening dialog is a small page belonging to the extension, shown in a frame on the page you right-clicked, so it has to be declared as reachable from a website. It refuses to display unless the extension itself just opened it: opening it needs a single-use approval value that the extension creates for that one dialog, that expires after a minute, and that stops working the moment it is used once. Its address is also randomised for each browser session, so a website cannot use it to detect that Clikso is installed or to identify you across sites.
Keyboard shortcuts. The extension registers two shortcuts — one to open the popup, one to shorten the current tab. They only fire when you press them, and you can change or clear them in your browser's extension shortcut settings.

7. Limited Use of Information

Our use of information received through the extension is limited to providing or improving the extension's single purpose — shortening and managing your Clikso links.

We do not sell this information. We do not use it for advertising, retargeting, personalised advertising, or interest-based advertising. We do not use it to determine creditworthiness or for any lending purpose. We do not transfer it to third parties for any of those uses. And we do not allow humans to read it, except with your consent, for security or legal reasons, or in aggregated or anonymised form.

This meets the Limited Use requirements of the Chrome Web Store User Data Policy, and we apply the same rule on every browser store we publish to.

8. How to Disconnect or Delete Your Data

You are in control, and there are three ways to stop the extension.

Disconnect from inside the extension. Open the extension options and press Disconnect on a workspace. This revokes that workspace's API key on our servers and clears that workspace's key and cached data from your device. Once revoked, the key stops working everywhere.
Uninstall the extension. Removing the extension deletes everything it stored on your device, including the keys, the cache and your settings.
Revoke from the dashboard. Sign in to Clikso and go to Settings → API keys. You can revoke any extension key from there, at any time, even if you no longer have the browser installed.

Disconnecting or uninstalling removes local data. It does not delete the short links you already created — those live in your Clikso account and are governed by our main Privacy Policy, which also explains how to request access to or deletion of your account data.

9. Children

The extension is not directed at children. It is a tool for Clikso account holders, and a Clikso account is not intended for anyone under 13 (or under the minimum age in your country). We do not knowingly collect data from children. If you believe a child has used the extension with an account, email support@clik.so and we will remove the data.

10. Changes to This Policy

We may update this policy as the extension changes. When we do, we will update the effective date at the top of this page and publish the new version here. If a change is significant, we will say so in the extension or by email.

Continuing to use the extension after a change means you accept the updated policy.

11. Contact Us

Questions about this policy, or about data the extension handles:

Email: support@clik.so

Playxoft Studios Private Limited https://clik.so