Legal

Privacy Policy

Effective: October 9, 2026 (2026-10-09)Last updated: October 9, 2026 (2026-10-09)

This policy explains exactly what AR Dynamics Inc collects when you use CybrGate, what the product is built not to collect, how long we keep what we hold, and how to exercise your rights. Every statement here is written against the product's actual code and database schema as of the effective date, not a template.

The short version

Page content is scanned in the page and never transmitted. A finding carries a signature id and where in the text it matched, never the matched text.
The free tier transmits nothing at all. No account, no server, no telemetry.
Paid seats send an extension inventory and, only if the customer allows it, an event journal. Every event type has an explicit field allow-list, and anything undeclared is dropped.
Retention is set per customer: 1 to 730 days, default 90.
The profile identifier is a locally generated random value, not a device serial, username or MAC address.
No cookies, trackers or analytics on this website.

1 Who we are #

The data controller for account, billing and website data is AR Dynamics Inc, a Hawaii corporation, operating CybrGate. For data about a customer's own fleet (extension inventories and events from the customer's employees' browsers), AR Dynamics acts as the customer's processor, and the customer is the controller; see the Data Processing Agreement. Contact: hello@ardynamicsinc.com, or by post at 200 Vineyard Blvd, Suite A325 #5128, Honolulu, HI 96817.

2 What CybrGate does NOT collect #

These are properties of the code, not intentions:

Page content. The page-side scan runs in the page. The matched text is never carried out of it: a finding holds a signature id, an offset and a length. What is recorded about a detection is the signature id, a severity and the page's origin.
Full URLs, form values, selected text, clipboard contents, cookie values, or anything typed. The event journal is not allowed to hold them, and a field that is not on the allow-list for its event type is dropped before the event is stored (Section 4).
Your browsing history. CybrGate does not request the history, cookies, clipboardRead, downloads, debugger, nativeMessaging, pageCapture, desktopCapture, proxy, tabs or scripting permissions. The tabs permission would let it read the URL of every open tab, and it does not need that permission to message a page it already runs on. Its manifest declares only management, storage, alarms, webRequest and notifications, plus access to all sites so the page-side scan can run wherever an agent might act. Each is documented, with the reason, in the extension's PERMISSIONS.md.
A device identifier. The profile fingerprint is a random 192-bit value generated locally in the browser and stored in extension-private storage. It is not a device serial, username, MAC address, or anything derived from the machine.
Anything, on the free tier. With no organization, the extension runs in local-scan mode with telemetry set to none, makes no network request to us, and enforces nothing.
Card numbers. Payment is handled by Stripe on Stripe's pages.
Cookies or analytics on this website. See Cookies & Tracking.
Biometric, health or government-identifier data. None is collected.

3 How the extension handles data #

All of the following happens on the device. Nothing in this section is transmitted unless Section 4 says so.

Inventory. Once at install and then hourly, CybrGate reads the installed-extension inventory from chrome.management (name, id, version, permissions, host permissions, install type, update URL) and scores it locally.
Page scan. A content script runs on every page and reads the page's visible text, text hidden from the user, and attributes an agent might read but a person does not (alt, title, aria-label, placeholder, and tool-description attributes), up to a fixed size, and scans it against deterministic signatures. Hidden text is read on purpose, because content an agent can read and a person cannot see is the mechanism of indirect injection.
Action classification. When a click or form submission happens, the script reads the target's tag, name, label text (capped at 120 characters) and form-field names to decide whether it is a high-risk action. The classification is recorded. The text is not.
Destinations. CybrGate observes which hostnames other extensions request, from the request's initiator. It keeps hostnames only, never paths or query strings, and at most 40 per extension.
Local storage. The extension keeps an append-only, hash-chained journal of up to 2,000 entries, the last verified policy, a per-extension baseline for spotting escalation, and the random profile fingerprint, in chrome.storage.local, which web pages cannot read. Chrome removes an extension's storage when the extension is uninstalled.

4 What a paid seat sends #

A paid seat is enrolled by a single-use token from the customer's administrator, over HTTPS only (the extension refuses a non-HTTPS server address). What it sends is capped by the customer's managed policy, independently of what the server asks for, at one of three levels:

none: nothing is sent.
inventory (the default for an enrolled browser): the extension inventory (id, name, version, type, enabled state, install type, update URL, permissions, host permissions), the hostnames other extensions were observed contacting, and the scan time. The server re-computes every score from the raw permissions and ignores any score the browser sends.
events: the inventory, plus the event journal below.

The journal has an explicit allow-list of fields for each event type. Anything not listed is dropped, strings are cut to 256 characters, and arrays to 50 entries. Each entry also carries a sequence number, a timestamp, and the hash of the entry before it. An origin means scheme, host and port only, never a path or query. This table is the complete list:

Event types and the only fields each may carry
Event type	Fields
`scan.completed`	extensionCount, worstScore, worstExtensionId, bands, needsAttention, unenriched, durationMs
`extension.added`	extensionId, name, version, score, band, installType
`extension.removed`	extensionId
`extension.escalated`	extensionId, name, from, to, addedPermissions, addedHosts, gainedUniversal, score, band
`extension.destination`	extensionId, hostname, declared
`policy.applied`	rev, source, telemetry, enforce, blockBands, gateActions
`policy.rejected`	reason, source, attemptedRev
`action.gated`	actionType, origin, agent, decision, signature, latencyMs
`injection.detected`	origin, signature, severity, stage, action, agent
`enforcement.applied`	extensionId, disposition, reason
`seat.enrolled`	seatId, reEnrolled, overLimit
`bridle.error`	where, code

Two fields deserve plain words. origin (on action.gated and injection.detected) is the site where CybrGate detected an injection or gated an action, so a customer's administrator can see which sites those were. An origin is a hostname, and a hostname can itself reveal context; that is why it is recorded only for those two event types and never for ordinary browsing. agent is a generic label such as "A browser AI agent" or "An automated browser session", or empty.

If the customer chooses a seat label at enrollment, we store it with the seat. A label is chosen by the customer's administrator, and the customer decides whether it identifies a person.

5 What we store #

This is the complete list of what the CybrGate server holds, from the database schema.

Data categories, purpose, legal basis and retention
Category	What	Purpose and legal basis	Retention
Organization record	Organization name and slug, plan, seats purchased, retention setting, Stripe customer and subscription identifiers.	Provide and bill the Service. Contract.	While the organization exists.
Administrator accounts	Email address, role, a salted scrypt password hash (never the password), a TOTP secret if enrolled, MFA enrollment and last sign-in times.	Authenticate administrators. Contract; legitimate interest (security).	While the organization exists.
Console sessions	A hash of the session token (never the token), the sign-in IP address, the browser's user-agent (first 300 characters), and times.	Keep an administrator signed in; investigate abuse. Legitimate interest (security).	A session is valid for 12 hours (30 minutes for a privileged account that has not yet enrolled MFA). Expired session records are not deleted on expiry.
Sign-in attempt counters	A hash of the email address, failure count and lockout time.	Per-account lockout against password guessing. Legitimate interest (security).	Cleared on a successful sign-in; failures decay after an hour without a new one.
Seats	The random profile fingerprint, an optional label, and enrolled, last-seen and revoked times.	Tell two browsers apart; count seats. Contract.	While the organization exists.
Enrollment tokens	A hash of the token (never the token), expiry, who issued it, and which seat used it.	Single-use enrollment. Contract; legitimate interest (security).	While the organization exists.
Extension inventory	Per seat and per extension: id, name, version, type, enabled state, install type, update URL, permissions, host permissions, and the computed score, band, reasons and unassessed checks.	The fleet view and risk findings. Contract; customer instruction.	Current state only: when an extension disappears from a seat, its row is deleted at that seat's next inventory upload.
Events	The allow-listed journal fields in Section 4, with sequence number, hash, previous hash, and times, and the chain head each seat reported.	The audit timeline and tamper detection. Contract; customer instruction.	The customer's retention setting (Section 7).
Policies	Each published policy revision, its signed token, and who published it.	Deliver signed policy. Contract.	While the organization exists.
Audit log	Acting user or label, action, target, a detail diff, and the actor's IP address, for sign-ins, MFA changes, policy publishes, token issues and seat enrollments.	Security and accountability; evidence for the customer's own audits. Legitimate interest.	Append-only. Removed only by an erasure carried out on an owner connection.
Security shield records	For blocked requests only: IP address, user-agent, request path, a redacted capture of the request, and the ban applied. Bans escalate and expire automatically.	Block attacks and abuse. Legitimate interest (security).	Block log: retained as a bounded rolling log of the most recent blocked-request records (about 60 MB by default); older entries are dropped automatically as the log rotates. A ban expires on its own.
Billing	Held by Stripe: payer name, email, payment method, billing address, invoices. CybrGate keeps the Stripe identifiers only.	Take payment, renew, refund. Contract; legal obligation (tax).	Per Stripe's retention as our processor.
Correspondence	What you send us when you write to support or privacy.	Respond to you. Contract; legitimate interest.	As long as needed to resolve the request and meet legal obligations.

Every table that holds customer data has row-level security enabled and forced, so one organization cannot read another's rows. We do not sell personal information, and we run no analytics or advertising trackers.

6 AI and automated processing #

CybrGate uses AI in one place. A local Gemini Nano classifier, reached through the Chrome Prompt API on the user's own device, acts as a second-stage false-positive filter. How it works:

Deterministic signatures run first. Only when the result is ambiguous (a score from 20 to 69) is the classifier asked, and it is given a short excerpt of that text: up to 2,000 characters from the page script, trimmed to at most 4,000 characters before the model sees it.
The excerpt goes from the page to CybrGate's own background worker in the same browser, and from there to Chrome's on-device model. It is not uploaded, not stored in the journal, and not sent to us or to Google by CybrGate. Chrome's own handling of the model is governed by Google's terms and privacy policy, not this one.
It can only lower a verdict, only when it answers "benign" with at least 0.8 confidence, and its answer must match a fixed schema or it is discarded. It has no tools and takes no actions. Its only output is a label and a confidence.
Where it influenced an event, the event's stage field records "classified" rather than "deterministic".
CybrGate does not trigger the model download. If the model is absent, CybrGate runs on signatures alone, which is the supported configuration.

Outputs may be inaccurate. A classifier can be wrong and is not professional, legal, security or compliance advice. No decision with legal or similarly significant effect on a person is made by it. CybrGate has no chatbot and produces no AI-generated text, image, audio or video. We do not train any model on Customer Data.

7 Retention #

Retention of events is configurable per customer: 1 to 730 days, with a default of 90. The period is stored on the organization record (default 90), and every policy revision an administrator publishes carries a value that travels to each browser in the customer's signed policy. Every policy revision is kept, and every publish is audit-logged. Enforcement of deletion at expiry: The retention purge runs daily as a Vercel cron at 03:00 UTC. Backups are not scheduled on Vercel. The database is Neon Postgres, and Neon's built-in point-in-time restore applies.

On request, after cancellation or at any time, we will erase an organization's data, including the append-only tables; the database permits that deletion only on an owner connection that asserts an erasure context, and the application role holds no delete permission on those tables. Write to hello@ardynamicsinc.com.

8 Subprocessors #

These are the only third parties that process personal data for CybrGate, and each can be pointed to in the product. The list is also in the Data Processing Agreement.

Subprocessors
Subprocessor	Role	Location
Stripe	Payment processing and billing	Per Stripe's documentation
Neon	Hosts the Postgres database that holds the data in Section 5	Neon
Vercel	Runs the CybrGate API and serves this website	Vercel
AR Dynamics Inc	Receives support and privacy email at hello@ardynamicsinc.com	AR Dynamics Inc, hello@ardynamicsinc.com

Google is not a subprocessor: the local classifier runs inside the user's browser, and CybrGate sends no page text to Google. We use no analytics provider or advertising network.

9 International transfers #

Where personal data moves between regions, for example from the EU or UK to a provider outside it, we rely on the transfer mechanism described in the Data Processing Agreement. We have not independently certified our providers' safeguards and make no representation beyond what they state in their own public documentation.

10 Cookies & tracking #

This website sets no cookies and loads no analytics or advertising trackers, and its fonts are served from the same origin. The only cookie in the service is one strictly necessary session cookie on the administrator console. The extension uses extension storage, not cookies. We honor the Global Privacy Control signal. Details: Cookies & Tracking.

12 Your rights (CCPA / CPRA) #

If you are a California resident:

Categories collected in the last 12 months: identifiers (administrator email, IP address, the random profile fingerprint, an optional seat label); commercial information (subscription, seat counts); internet or network activity (extension inventory metadata, hostnames other extensions contacted, and the origin of pages where an injection was detected or an action was gated); and the content of anything you send us.
We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not in the last 12 months.
Sensitive personal information: an administrator's account login together with a password hash and, if enrolled, a TOTP secret is sensitive personal information under the CPRA. We use it only to authenticate you, not to infer characteristics, so there is nothing to limit.
You have the right to know, delete and correct, and not to be discriminated against for doing so. An authorized agent may act for you; we verify the request against the administrator account.

13 If your employer deployed CybrGate #

If CybrGate is on your work browser, your employer chose that, and your employer is the controller of the fleet data. An administrator at your employer can see which extensions are installed on your profile and how they score and, if the events level is on, the origin of a page where CybrGate detected an injection or gated an action. They cannot see your page content, your full URLs, your browsing history, your form entries or your clipboard, because CybrGate never receives them. By default you can see your own report in the extension, and your employer can turn that off.

To exercise rights over that data, contact your employer first. If you write to us, we will pass your request to the customer, because we process that data on its instruction.

14 Children #

CybrGate is not directed to children under 13, and not to anyone under 18. We do not knowingly collect their data. If we learn we have, we will delete it.

15 Security measures #

As of the effective date, the product does the following:

The extension talks to the server only over HTTPS and sends no cookies; the agent surface authenticates with a signed, expiring seat license.
Policy bundles and seat licenses are Ed25519-signed, and the extension rejects an unsigned, badly signed or expired policy and falls back to its last verified one.
Row-level security is enabled and forced on every customer table, and the application connects as a least-privilege role that cannot bypass it and has no update or delete permission on the audit log or events.
Passwords are hashed with salted scrypt. Enrollment and session tokens are stored only as hashes. Owner and admin accounts must use TOTP two-factor authentication.
The console session cookie is HttpOnly and SameSite=Strict, scoped to the console path.
Sign-in is limited per IP address and per account, with identical responses for unknown accounts and wrong passwords. An application firewall blocks attack traffic.

No system is perfectly secure. We designed CybrGate to hold as little as possible in the first place.

16 Breach notification #

If a security incident affects personal data, we will notify the affected customers' administrators and, where the law requires, the relevant authorities, without undue delay and in line with applicable law, including state breach-notification laws and the GDPR. For Customer Data we will assist the controller with its own obligations.

17 Law-enforcement requests #

We act only on valid legal process that is enforceable against us. Because CybrGate never receives page content, full URLs or browsing history, we have none of that to provide; a valid request can reach only what Section 5 lists. Outside legal process we may disclose limited data only where we believe in good faith that doing so is necessary to prevent an imminent risk of death or serious physical injury. We have not published a transparency report.

18 Changes to this policy #

We may update this policy. We will change the "Last updated" date and, for material changes, give reasonable advance notice, for example to the organization's owner.

19 Contact #

Privacy questions and requests: hello@ardynamicsinc.com. Postal address: 200 Vineyard Blvd, Suite A325 #5128, Honolulu, HI 96817.