Privacy Policy — Threadlinqs Threat Intel Enrichment

Chrome extension by the Threadlinqs team. Last updated: 10 July 2026.

The Threadlinqs Threat Intel Enrichment extension ("the extension") live-highlights indicators of compromise (IOCs) on the sites you choose and lets you enrich them with threat intelligence from Threadlinqs (intel.threadlinqs.com). This policy explains exactly what the extension reads, what it sends, and what it does not do.

The extension runs only on sites you enable

The extension does nothing on any site until you explicitly enable it there from the toolbar popup (which grants a per-site permission for that one site). It has no standing access to your browsing, does not track your browsing history, and never runs on a site you have not turned on. It also stays inert by default on common banking, webmail, and login domains (an editable sensitive-site list), even if you enable them.

Highlighting is 100% local

On a site you have enabled, the extension scans the page's visible text entirely within your browser to find and underline indicators (IP addresses, domains, URLs, email addresses, file hashes) and CVE identifiers. This scanning and highlighting happens locally on your device, requires no account, and sends nothing over the network.

What is sent, and only when you click

• A clicked indicator. When you click a highlighted indicator, that single indicator's value (e.g. one IP, domain, hash, or URL) — not the page, and not your browsing — is sent to intel.threadlinqs.com to return matching threat intelligence. The result is cached locally in your browser for 24 hours. If you never click an indicator, nothing is ever sent.
• Your account key (only if you add one). Enrichment requires a Threadlinqs API key. If you paste one in the extension's settings, it is stored only in your browser (chrome.storage.local) and sent solely to intel.threadlinqs.com as a Bearer token to authenticate your enrichment requests. You can remove it any time with "Disconnect." Highlighting continues to work without a key.

What is NOT collected

• No browsing history, no page contents, and no page text beyond the single indicator value you click.
• No analytics, advertising, fingerprinting, or third-party trackers in the extension.
• No selling or sharing of any data with third parties. Requests go only to Threadlinqs' own API.

Where data goes

All network requests from the extension are made to https://intel.threadlinqs.com and no other host, over HTTPS. A clicked indicator is used to return relevant threat-intelligence results and may be processed in Threadlinqs' normal service logs consistent with the Threadlinqs service terms.

Data retention & control

The extension stores locally, in your browser only: your optional API key, the list of sites you have enabled, your sensitive-site list, and a 24-hour cache of enrichment results. Disabling a site revokes its access and clears its highlighting; "Disconnect" deletes your stored key; removing the extension deletes all of the above.

Consent

On installation, the extension presents an in-product summary of exactly what it collects and sends, and requires your explicit agreement before any enrichment request is made.

Contact

Questions about this policy: contact@threadlinqs.com.