Privacy
Short version: your camera feed never leaves your device, and we have no way to see it.
What happens to the video
When you press Start, your browser asks you for camera permission and hands the stream to the page. Each frame is passed to an on-device face detection model (MediaPipe BlazeFace, running in WebAssembly or WebGL inside your browser) which returns a handful of numbers: where any faces are and how confident it is. The frame is then dropped. Nothing is written to disk and nothing is transmitted. The model and its runtime are served from this site, so no third party is contacted while it runs.
What we store
Your settings and anything you type in Private notes live in your browser's local storage, on your device. Files you open in the viewer are read locally through a temporary object URL and are never uploaded. There are no accounts and no database behind this site.
No face recognition
ShoulderSurf detects that a face is present and roughly which way it is turned. It does not identify who the face belongs to, build templates, or compare faces between sessions. “You” is simply the largest face in frame at any moment.
Analytics
None. Standard web server access logs (IP address, path, user agent) are kept briefly for operations, as with any website.
The Chrome extension
The extension runs the same model in a hidden extension page and tells the tabs you have open whether to blur. It requests camera access and permission to run on all sites, which it needs to draw the blur over any page. The script it puts on each page only adds a fixed overlay element and shows or hides it on the extension's instruction; it does not read page text, form fields, or anything else on the page, and it sends nothing about the page anywhere. The face model is bundled inside the extension, so no code or model is downloaded while it runs.
Licensing
The extension is free for 30 days after install, then needs a subscription. The trial start date is stored in your Chrome profile. When you subscribe, Stripe handles payment and holds your email and card details under its own privacy policy; we store your email, the license key we issue, and the Stripe subscription status so the extension can check it. That check is the only network request the extension makes: about once a day it sends your license key, and nothing else, to shouldersurf.ftmq.com and gets back whether the subscription is active. The camera feed and page content are never part of it.