CLOCKEDF12 is a browser extension that examines the technical information a website delivers to your own browser and organizes it for investigators. This policy documents exactly what the extension inspects, where the results live, what leaves your machine during optional follow-up research, and what never does.
What the extension inspects
Every scan is initiated by you, on the tab you choose, when you press Start scan. There is no background collection: nothing is inspected before you start a scan. A scan you start keeps running in the background if you close the side panel, because closing the panel only closes the viewing window, not the investigation. Reopening the panel shows the live session again. An active scan ends when you press Stop scan, when you close the tab, or when the browser detaches the inspection session (for example if you open DevTools yourself); whatever was collected up to that point is then analyzed. While a scan runs on a page, CLOCKEDF12 inspects:
- Network activity: requests and responses the page makes, including URLs, methods, status codes, headers, timings, response bodies, request payloads, WebSocket connections and their message frames, redirects, and which element or script initiated each request.
- Webpage content: the page's HTML structure, inline and loaded JavaScript, stylesheets, HTML comments, hidden elements and attributes, temporary DOM changes observed while monitoring, and metadata embedded in images.
- Identifiers: email addresses, usernames, account identifiers, UUIDs, domains, IP addresses, timestamps, URLs, and similar values found inside captured records.
- Browser records for the site: cookies, localStorage, sessionStorage, IndexedDB contents, Cache Storage entries, and values on the page's global JavaScript object.
- Site configuration: the site's own robots.txt, sitemap.xml, and web app manifest, fetched as clearly identified read-only checks against the site you are scanning.
- Console output and standard files: console messages and recoverable source maps declared by loaded scripts.
This can include sensitive information. Captured records may contain session cookies, tokens, API keys, and other values that function as authentication secrets, because websites send those to your browser as part of normal operation. CLOCKEDF12 classifies such values and masks usable authentication secrets in the interface and in ordinary exports: the field name, source, type, value length, and edge characters are preserved so every finding stays identifiable, while the usable middle is protected. The full value can be revealed inside the live extension session on your own machine, and nowhere else.
Where investigation data is stored
Investigation sessions live on your machine only: in the extension's memory while it runs, in your browser's local extension storage, and in a local IndexedDB evidence store for captured response bodies. Nothing is synchronized to any account or cloud.
You can clear investigation data at any time: starting a new scan on a tab replaces the previous session for that tab, and removing the extension deletes its stored data entirely. You can also clear the extension's storage from your browser's extension management page. Closing the browser ends every in-memory session.
Exports and reports
Exports are files you generate yourself: they download from your browser to a location you choose. Ordinary exports and reports mask usable authentication secrets as described above, but they still contain detailed investigative evidence about the page you scanned: URLs, record fields, identifiers, timestamps, technical metadata, and the masked traces of credentials.
Treat an export as sensitive material. Anyone holding the file can read everything in it, and masked values still reveal that a credential exists, where it lives, and how long it is. Share exports only with people who are authorized to see the underlying evidence, and delete them when they are no longer needed.
External public-source lookups
When a finding qualifies as a genuine lead, CLOCKEDF12 can perform follow-up research against public sources. This is the only situation in which the extension sends any value anywhere, and it is bounded by a strict per-investigation request budget. The services contacted and what each receives:
- Google Public DNS (
dns.google): the domain name or reverse-DNS name being resolved. - RDAP (
rdap.org): the IP address or domain name whose public registration record is requested. - Certificate transparency (
crt.sh): the domain name whose public certificate history is requested. - Internet Archive Wayback Machine (
web.archive.org): the domain or page URL whose public capture history is requested.
These lookups send only the queried identifier or URL. They never include your investigation targets as a list, your other findings, cookies, credentials, or any captured page content. Each lookup is recorded on the finding with the source queried, what was searched, when, and the outcome, including failures. Timestamp conversion and cross-record comparison are performed locally and contact no one.
What is sent to The OSINT Vault
Nothing. The extension contains no analytics, no telemetry, no crash reporting, no account system, and no code that contacts any server operated by The OSINT Vault. We never see your targets, your findings, your exports, or the pages you scan.
Other network requests
Beyond the optional public-source lookups, the extension's remaining network requests fall into three groups:
- Requests to the website being investigated: the standard configuration files of the site you are scanning (robots.txt, sitemap.xml, web app manifest), fetched directly as clearly identified read-only checks.
- Requests to external resources referenced by that website: in two narrow cases the extension fetches a file from a URL the page itself pointed to. Some Chrome builds return empty image data through the inspection channel, so to complete the metadata check the affected image file is requested once more, without credentials, and that retry is recorded in the evidence. Source maps declared by loaded scripts are fetched the same way. If the page loads an image or script from an external domain, that external host receives a request for its own file, nothing else.
- Optional public-source investigative lookups: the DNS, RDAP, certificate transparency, and Wayback Machine queries described above, which send only the queried identifier or URL.
All of these fetches are made without your cookies or login state. None of them carry captured page content, credentials, findings, or reports. The extension loads no remote code, fonts, images, or scripts of its own from anywhere.
Limited Use compliance
CLOCKEDF12's use and transfer of information received from Chrome APIs to any other app adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Changes to this policy
If the extension's data handling changes, this page changes with the release that introduces it, and the date at the top is updated. No change will ever quietly widen what leaves your browser.
Contact
Privacy questions, concerns, and requests go to the publisher directly: theosintvault@gmail.com.