Privacy design
Where tool inputs, page reads and source visits go.
This page explains the product boundaries behind the privacy policy. The policy is the full statement of what Coeus stores and sends.
A tool does not open a source
The embedded tools process supplied text, files and images in your browser. Supported input is analysed automatically in the side panel. A tool draft or result is working-session data, not a Saved item or a source lookup. Opening a tool does not visit VirusTotal, urlscan.io or any other source.
The shared search recognises tool names and indicator types locally. A recognised domain, IP address or other indicator first opens focused detail in the side panel. A source receives the value only when you choose that source or Open all sources in tab group. Those sites then receive the value in the link and the normal network information of a browser visit. Coeus does not ask for or store their API keys.
Page access is bounded
The extension has broad website access so it can inspect a page you ask about. The manifest contains no static content_scripts: it injects a reader for a requested scan or an enabled page feature rather than running one on every page by default.
Scan page reads a bounded snapshot of visible content and shows possible inputs in the side panel. The optional Page suggestions setting can make quiet suggestions as you browse. Hidden content, passwords and editable fields are excluded from passive suggestions. A page finding can become stale after navigation or a document change; Coeus checks that before acting on it. See Page scan for the limits.
A separate optional notice can identify a visible password form whose declared destination uses HTTP. It reads form attributes, not what you type, and does not submit the form. You can pause notices for that site.
Chrome prevents inspection of browser-owned pages, other extension pages and some embedded content. A remote image may also block a local QR or metadata reader; selecting a local file avoids a second request to the image host.
Browser state
Coeus has no accounts. Sources, settings, existing subscriptions and Saved items are stored in the browser, and Coeus keeps no copy. If you use Chrome sync, Chrome can also carry your settings and sources to your other signed-in browsers; source choices marked this browser only stay in this one. Tool inputs and results are never part of that.
Earlier Coeus versions let you explicitly Save entities. Those records remain in this browser, but the current Tools workflow does not require Save or Trace.
Screens and analytics
The side panel and full-page Tools view are served from the Coeus website and cached by the browser. A screen request includes the extension version; it does not carry the current tool input or indicator. The framed page has no extension privileges of its own and reaches browser capabilities only through validated messages.
Anonymous usage analytics use fixed fields only. They do not record search terms, tool inputs, files, page bodies or the indicator in a screen URL, and the random installation identifier is stored only as a one-way hash. You can turn usage analytics and crash reports off in Settings → Privacy. The privacy policy gives the collection and retention details.
Check the boundary yourself
- Review Coeus under
chrome://extensions→ Details to see its site access. - Open a local tool and watch the extension's network activity; it does not need a source request to produce a result.
- Open one source deliberately and inspect the destination URL before you use that site.
- Review what leaves your browser in the policy.