Single purpose
Flash Route is designed only to select and apply routes to supported online services in Chrome.
Chrome Data Use
Which Chrome API data is required for Flash Route's single purpose and how Limited Use applies.
Limited Use
Use and transfer of information received from Google Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Data processed
Through Chrome APIs the extension processes selected services and their domains, proxy and permission state, random install/device identifiers, platform and version, local account state and short-lived access data. The signed installation attestation is stored locally and in Chrome Sync when synchronisation is enabled. For the first successful route, only the service ID, UTC timestamp and fixed route class authorized_selected_service are stored locally once. Active correlation records use Chrome's request ID only to bind the current route generation and owned proxy endpoint until the terminal request event or browser session ends; this is not a separate store with an independent count or time limit. Only rejected terminal tombstones are bounded to at most 128 records with a 60-second TTL. Visited URLs, page content, cookies and credentials are not stored in this correlation. During bounded recovery, the extension checks a fixed selected-service endpoint with a HEAD request and random nonce, without credentials or a body; it does not repeat the failed user's URL, is valid for at most 30 seconds and is bounded by the recovery deadline, and remains a local observation rather than proof of server-side acceptance or independent egress.
Use limitation
Chrome API data is used only for selective routing, account, trial, licence, purchase, security, recovery and support of this feature. It is not sold, transferred to data brokers, used for unrelated advertising or credit decisions, or used to build a browsing profile.
Data the extension does not read
There are no content scripts. Flash Route does not read page or chat content, password fields or other form data, user files, or browsing history.
First-use disclosure
The existing first screen of a new installation shows data categories, purposes and a Privacy link before trial, sign-in, purchase or proxy routing. The first existing sign-in, trial, access-key or Plans action is the user action before API or proxy processing. There is no separate consent window, checkbox, acceptance button or versioned data-use acceptance state. Previously authenticated users do not repeat onboarding solely because of this copy change. Until that first action, selected services remain locally fail-closed without DIRECT. The package declares 28 required host patterns: 25 for five supported services, one for Route Proof route-proof.flashroute.app, and two broad HTTP/HTTPS patterns (http://*/* and https://*/*). Chrome needs the broad patterns to deliver proxy-authentication challenges when a selected service is opened from another site; service selection controls routing and credential authorisation, not a new host-permission grant. Route Proof can run automatically to confirm a route or manually from diagnostics; it is not a selectable service and does not change the selected route. The Flash Route API is covered by the required HTTPS pattern; there are no optional host permissions.
Transfer and retention
Recipients and retention match the published Privacy Policy: infrastructure/hosting, email and payment providers only for the corresponding action, and Chrome Sync only by user setting; short-lived data expires, local logs are capped, and other records are retained only as necessary for the stated purposes and applicable requirements.
Human access
Human access is allowed only with explicit support consent, in anonymised form for internal operations, for security, or when required by law.
Permissions
The manifest declares 28 required host patterns: 25 for five supported services — YouTube, ChatGPT, Gemini, Grok, and WhatsApp Web, one for Route Proof route-proof.flashroute.app, and two broad patterns, http://*/* and https://*/*. The broad HTTP/HTTPS patterns give Chrome web-origin access needed for proxy-authentication challenges from selected services; the authentication listener and onCompleted/onErrorOccurred processing are limited to supported-service domains. The extension uses no content scripts and does not read page content. The Flash Route API is covered by the required HTTPS pattern; there are no optional host permissions. Optional privacy is requested separately for WebRTC protection.