Privacy Policy

The short version

Utilvo Sandbox contacts no server of its own — not to check licenses, not for analytics, not for anything. Every protection runs as local code inside your browser. The only network traffic the containment tab makes is the traffic you'd expect: your browser talking directly to whatever site you typed in, same as any normal tab.

What happens entirely on your device

• Stripping framing-related response headers (X-Frame-Options, Content-Security-Policy, Cross-Origin-*-Policy) from the previewed page's own responses, so it renders inside the containment frame — done locally via the browser's network-rules API, not by routing traffic through any server.
• Intercepting the previewed page's own JavaScript — cookies, storage, clipboard, camera/microphone, WebRTC, WebAssembly, and the rest — to stop it acting outside the frame. This runs as a script injected directly into that tab.
• Your protection preset and the 30+ individual toggle settings — stored locally via the browser's extension storage, never transmitted anywhere.
• The live block log and risk score shown inside each containment tab — generated and kept entirely in that tab, discarded when you close it.

What gets deleted, and when

With Clear Storage on Close enabled (on by default in Medium and Strict), closing a containment tab wipes that origin's cookies, localStorage, IndexedDB, and cache from your real browser profile immediately — using the browser's own data-clearing API, scoped to just that origin.

What we don't do

• No analytics, telemetry, or usage tracking of any kind.
• No server of ours ever sees the URLs you preview.
• No advertising, no ad networks, no retargeting.
• No sale or sharing of your data with anyone — there's no data collected to sell.
• No account required to use the extension.

Why the extension asks for broad permissions

Utilvo Sandbox requests access to all sites because it has to strip framing headers and inject protections into whatever page you decide to preview — which could be any domain. It also requests browsing-data access, used exclusively to wipe a previewed origin's cookies and storage on Clear Storage on Close. Neither permission is used to read or collect data from sites you're not actively previewing.

Questions

If anything here is unclear, or you want more detail on a specific feature, reach out via the contact details on the main Utilvo site.