Skip to content
FixAEO

AEO Quick Check — Extension Privacy Policy

Last updated:

Summary

The AEO Quick Check Chrome extension shows an AI search visibility score, measured with Google Gemini, for the site you're viewing. It runs only when you click its toolbar icon. It has no background script, does not read pages you aren't actively checking, and does not include any analytics, tracking, or telemetry.

This page covers the extension specifically. The broader fixaeo.com website privacy policy at fixaeo.com/privacy/ describes how our backend handles the request that the extension makes — read it alongside this page.

What the extension reads

When you click the extension's toolbar icon, Chrome grants the extension the activeTab permission — and only at that moment. The extension reads exactly one piece of information: the URL of your current tab. From that URL it keeps only the root domain (e.g. blog.uber.com becomes uber.com); the path, query string, and fragment are dropped and never sent. Cookies, page content, and form data are never read.

The extension does not request the broad host_permissions that some extensions ask for. Its only host permission is for our own API, https://api.fixaeo.com/, so you will not see an “allow on all sites” install prompt.

What the extension sends to our servers

The extension makes three kinds of HTTPS request, all to api.fixaeo.com, and each one carries only the root domain (e.g. uber.com) or a scan ID:

  • GET /extension/lookup?domain=<root-domain> — when you open the popup, to fetch the saved score for that domain.
  • POST /scan — only when you click to run a free scan on a site we haven't scanned yet. It sends https://<root-domain>/. The free scan uses Google Gemini only.
  • GET /scan/<scan-id> — repeated every 1.5 seconds while that scan runs, to fetch its result.

No headers identify you, no cookies are sent, and no authentication token is attached.

Like any web server, our backend sees the IP address a request comes from. Lookups are not saved with it — the only trace is a short-lived rate-limit counter that expires within the hour. When you run a scan, we store a salted hash of it with that scan — never the raw IP — to enforce rate limits and prevent abuse. The result of a scan you run is saved against that domain, so the next lookup for it (yours or anyone's) is answered from the saved result instead of a new scan.

Links in the popup open pages on fixaeo.com tagged utm_source=extension, so our website analytics can tell those visits came from the extension. The fixaeo.com privacy policy covers those visits.

What the extension stores on your device

Using Chrome's storage.local API, the extension keeps two things: your last 5 checks (domain, score, a link to its report, and when you checked it), so the “Recent checks” panel works across sessions; and the scan in progress, if there is one (domain, scan ID, and start time), so reopening the popup picks it up instead of starting a second scan. This data:

  • Lives only on your device, in your local Chrome profile.
  • Is never uploaded to our servers or sent to any third party. The only part that leaves your device is an in-progress scan's ID, which the popup uses to ask our API for that scan's result.
  • Is not synced to your Google account (we use storage.local, not storage.sync).
  • Recent checks are cleared when you click the “Clear” button in the history panel. The in-progress scan record is removed when that scan finishes or fails. Uninstalling the extension removes both.

What the extension does NOT do

  • No analytics SDK is bundled into the popup. We do not know which buttons you click inside it.
  • No install ID or any other identifier for you or your browser is created, stored, or sent.
  • No background script. Nothing runs until you click the toolbar icon.
  • No collection of your browsing history. Only the domain you check is sent, at the moment you check it.
  • No advertising trackers, no cross-site tracking, no third-party scripts.
  • No collection of personally identifiable information — name, email, phone, address, payment, location, health, financial, or authentication data. None of these are read, requested, transmitted, or stored.
  • No reading of pages in background tabs. No content scripts injected into any site.
  • No selling or sharing of any data with anyone. We have no business model where extension data could be sold.
  • No remote code execution: the popup's JavaScript is fully contained in the extension bundle reviewed by Chrome Web Store. We do not load remote scripts at runtime.

Chrome Web Store data disclosures

Per Chrome Web Store policy, here is the explicit disclosure of data the extension handles:

  • Website content: Yes, limited to the root domain of your active tab when you click the extension icon. Used only to look up the brand's AI visibility score, or to scan it when you ask. Not sold, not shared with third parties, not used for marketing or creditworthiness.
  • User activity: No.
  • PII, authentication, financial, location, health, personal communications, web history: No, none of these.

Children's privacy

The extension is intended for SEO, marketing, and product professionals. It is not directed at children under 13. We do not knowingly collect any data from children under 13.

Changes to this policy

If we change how the extension handles data, we will update this page and bump the “Last updated” date at the top. Material changes will also be reflected in the Chrome Web Store listing.

Contact

Questions or data deletion requests: privacy@fixaeo.com.