Sonar Extension privacy policy

This policy explains what Sonar Extension, our free Chrome extension, reads and keeps when you use it. Sonar Extension does not need an account. It does not send inspection results or event evidence to Dolphin Analytics, or to any analytics service, on its own.

Who we are

Sonar Extension is made by Dolphin Analytics Limited, a company registered in England and Wales (company number 12157748), registered office Kemp House, City Road, London, EC1V 2NX. For anything in this policy, contact us at team@dolphinanalytics.co.uk.

What the extension reads

The extension only reads the page you choose, and only after you open it:

• When you inspect a page. It reads script references, inline configuration snippets (only to find tracking IDs), retained browser resource entries, selected tracking globals, supported data layers and retained Consent Mode commands in the top-level page. It uses these to identify supported tracking tools and technical IDs.
• When you start a check. It asks Chrome for access to that one site, reloads the selected tab and observes supported dataLayer and gtag events. It reads event payloads on your device to check the selected event name, count and fields.
• Order values. Numeric order values and three-letter currency codes may be processed and kept in local evidence. These fall within Google’s “Financial and payment information” category.

The extension does not read:

• form input values or browser cookies
• Chrome’s browsing-history database
• events from other frames
• raw clicks, pointer movement, scroll positions or keystrokes
• card details, bank accounts, passwords or payment credentials

The site you select is kept with the check. Google’s “Web history” category covers this selected site origin. The extension does not build a record of your general browsing.

What it keeps

Raw event payloads are not copied into extension storage. The extension keeps:

• About the page: the site origin, technical tracking IDs, data-layer names and counts, and Consent Mode states.
• About your check: the expected event and fields, timestamps, event names, field presence and type, item counts, numeric values and currency codes.

It drops transaction IDs, product IDs and names, form identifiers, email addresses, user identifiers, hashed customer details and other payload fields. A custom expected event name is kept exactly as you type it, so please use technical event names, not personal data.

How long it keeps data

• Session storage only. Observations live in Chrome session storage and the inspected page’s temporary memory. Closing Chrome clears session storage.
• Capped. A session stops at 500 supported events or 20 minutes.
• Clearable. Clear session removes the extension’s current record at any time.
• Your copies. Reports you download and text you copy stay under your control.
• Site access. Chrome remembers site permissions separately. Remove them in Chrome’s extension settings.

Sharing is your choice

• Reports. Downloading or copying a report happens on your device. Check a report before you share it, because site origins, tracking IDs and order values may be commercially sensitive.
• Speak to Dolphin. This button opens our contact page. It does not attach any evidence. If you send us a report through a contact form, our website privacy policy applies to that submission.
• Run the full Sonar scan. This button opens Sonar with the public site origin in the web address, so it sends that origin to Sonar and may start a scan. It sends no event evidence. The extension blocks this for IP addresses, localhost and common local hostnames.

Visiting the Dolphin website or Sonar is covered by those sites’ own privacy policies.

No advertising or telemetry

The extension has no advertising, telemetry, remote scripts or AI calls. It does not sell data or use inspection evidence for advertising.

Limited Use

Sonar Extension’s use and transfer of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only for the tracking inspection, selected event checks and evidence features described above. It is not sold, used for personalised advertising, used for unrelated purposes, or used to decide creditworthiness or for lending. Dolphin Analytics does not receive or read local evidence automatically. The optional Sonar scan sends only the selected public site origin, and only when you choose it.

What a check can’t prove

The extension observes what a page exposes. It cannot prove that data reached GA4 or another destination. It cannot assess legal compliance. It cannot fully observe server-side tracking, or events removed before it observes them.

Changes to this policy

If the extension starts handling data differently, we will update this policy and the date at the top before that version is released.

Contact

Questions about Sonar Extension or this policy: team@dolphinanalytics.co.uk, or use our contact page.