BaitWallBaitWall
Privacy policy
Effective date: 27 October 2026. This policy applies to the BaitWall browser extension for Chrome, Firefox and Microsoft Edge (version 1.2.0 and later) and to this website.
BaitWall warns you when a site lets you do the work for free (edit a PDF, build a resume, design a logo, fill in a form, make a QR code) and then asks you to sign up or pay to get the result. It shows free alternatives. It does not unlock, remove or get around any payment or login step.
Short version: no account, no ads, no analytics, no sale of data. Matching and scanning happen on your device. BaitWall sends something about a site only when you click Report this site or This is wrong, and then only the domain plus a few short labels, never the full address or the page content.
1. Who is responsible
BaitWall is developed and operated by its owner, Miłosz Mazurkiewicz (Poland), referred to here as “we”. We are the controller of the report data described below. Contact: contact@almmity.com.
2. What BaitWall does not do
- It does not collect your browsing history or the addresses of pages you visit.
- It has no analytics, no telemetry, no advertising and no user accounts.
- It does not sell, rent or share data with advertisers, data brokers or anyone else.
- It does not read form fields, passwords or payment details on the sites you visit.
- It does not run remote code. All of its code ships inside the extension.
3. Data that stays on your device
BaitWall uses the browser's local extension storage for:
- the on/off switch and your settings (including whether the optional scanner or paywall prompt is on);
- sites whose warning you hid, and sites you marked with “This is wrong”;
- a local copy of the site list and of the public lists described in section 6;
- results of the optional scanner, and the public pricing or terms text they are based on, kept for 7 days and then deleted;
- reports waiting to be sent (at most 40, see section 4);
- a random install ID (see section 4);
- only if you create one: the throwaway mail.tm inbox address, its password and access token (see section 7).
This data is not sent to us. Uninstalling BaitWall removes all of it. “Discard inbox” in the popup removes the inbox data.
Search badges and warning cards
On Google and Bing search result pages, BaitWall compares the result links with its list on your device and adds a badge next to matching results. On sites in the list, it shows a warning card. Your search query, the results and the pages you open are not stored or sent anywhere.
Optional on-device scanner and paywall prompt
Both are off by default. If you turn on “Scan tool sites for hidden paywalls” or “Watch for a paywall after Download”, the browser asks you for permission to run on all sites. Then BaitWall checks tool-like pages on your device for signs such as paid trials, “sign up to download” walls or auto-renew terms. It may fetch the same site's public /pricing, /plans or /terms page (same site, without cookies) to confirm. The paywall prompt notices clicks on Download or Export buttons, locally. The text and results stay on your device for 7 days and are not sent anywhere. Turning the settings off stops the checks.
4. Data sent to us, and only when you click
BaitWall sends data to our report server (https://baitwall.almmity.com/api) only when you click one of these buttons. Nothing is sent in the background about the pages you visit.
| You click | Fields sent |
|---|---|
| Report this site (popup, warning card or paywall prompt) | domain (for example example.com), pathCategory (one of home, download, checkout, account, tool, other), reason (one of pay-to-download, forced-signup, hidden-trial, other), kind = report, extensionVersion, installId |
| This is wrong on a Confirmed site | the same fields, with kind = counter and reason = other |
| This is wrong on a Likely warning (from the scanner) | the same fields, with kind = false-positive, plus signals: the names of the signals that matched, from a fixed set (paid-trial, pay-lock, account-lock, auto-renew, payment-vendor, download-wall). The warning is also hidden on your device. |
The full address, the path, the query string, the page title and the page content are never sent. The page category is computed on your device from the path and only the category name is sent.
Install ID. A random identifier (crypto.randomUUID()) created on your device the first time it is needed. It is not linked to your name, email or browser account. We use it only to count each install once, ignore duplicate reports and limit abuse. To get a new one, uninstall and reinstall BaitWall.
Offline queue. If a report can't be delivered (for example you are offline), it stays on your device (up to 40 reports) and BaitWall tries again later; it checks every 30 minutes. Reports are sent only to our server.
Limits. The server accepts up to 10 reports per install and 40 per IP address per day, and stores the same install, domain and kind only once. A domain appears in the public “reported” list only after at least 5 different installs reported it, and well-known brands are never published automatically.
How we use reports. Only to review and improve the site list and the warnings: to add sites, correct entries and stop warning about domains that were flagged by mistake. We never use them for advertising, profiling or any purpose unrelated to BaitWall's single purpose.
5. Where data is processed, and IP addresses
The report server, the site list and this website are operated by us on our own server, rented from Hetzner Online GmbH and located in Germany. Hetzner provides the hardware and network; we do not send report data to Hetzner or to anyone else. No other hosting, CDN or analytics provider is involved.
IP addresses. Like any internet server, ours sees the IP address of each request. The report server uses it only in memory to enforce the daily limit in section 4 (as a hash with a random key that changes every day) and forgets it at the end of the day or when the server restarts. The IP address is never written to the database, never stored with a report, and no hash of it is stored either.
The web server does not keep access logs for baitwall.almmity.com, including the API. If a request fails because of a server error, the error log entry may contain the IP address; it is used only to fix the problem.
This website uses no cookies, no trackers, no analytics and no third-party fonts or scripts.
6. Automatic downloads (no user data)
About every 12 hours BaitWall may download public data files from our server: an updated site list, a list of reported or confirmed domains, and a list of domains that were marked as wrongly flagged. These requests (to https://baitwall.almmity.com/api/) contain no information about you or the pages you visit. The server handles the IP address only as described in section 5. The public lists contain domains only, aggregated from reports, and never contain install IDs.
7. Throwaway inbox (mail.tm)
The inbox is optional. BaitWall contacts the free mail.tm service only after you click “Create inbox”. It then creates a temporary address, reads the messages sent to it, and deletes the inbox when you click “Discard inbox”. The address, password and token are stored only on your device and are sent only to mail.tm, never to us. Messages are shown in the popup and are not sent anywhere else. mail.tm is an independent third party and its own privacy policy applies: mail.tm/en/privacy. Do not use the inbox for anything sensitive.
8. Retention
- Report records (the fields in section 4): kept for up to 12 months, then deleted automatically. Domain-level results derived from them (for example “this domain was reported” or “this domain was flagged by mistake”) may be kept in the public lists for as long as they are useful.
- IP addresses: not stored; held in memory for at most one day for rate limiting (section 5). No access logs are kept for this site or the API.
- Data on your device: scanner results 7 days; everything else until you remove it or uninstall BaitWall.
9. Chrome Web Store Limited Use
The use of information received by BaitWall adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use data only to provide and improve BaitWall's single purpose. We do not sell it, do not transfer it to anyone (our server is rented from Hetzner, which only provides the infrastructure; mail.tm receives inbox traffic only after you create an inbox), do not use it for advertising, and do not use it to determine creditworthiness or for lending. No human reads your data except report fields when reviewing the site list.
10. Legal basis and your rights
If you are in the EU/EEA or UK: we process report data on the basis of our legitimate interest in keeping the warnings accurate and preventing abuse (Article 6(1)(f) GDPR), and only because you chose to send a report. Reports are not linked to your identity, so we usually cannot tell which reports are yours, but if you send us your install ID we will help. You have the right to access, correct, delete or object to the processing of your data, and to lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). Contact us at contact@almmity.com.
11. Permissions
| Permission | Why |
|---|---|
storage | Keep the settings, hidden warnings, lists, scan results, unsent reports, install ID and optional inbox on your device. |
activeTab | Read the current tab's address when you open the popup, to show its status and, if you report it, derive the domain and page category. |
alarms | Retry unsent reports every 30 minutes. |
| Google and Bing search pages | Show badges next to listed results. |
| Listed tool sites | Show the warning card on those domains only. |
https://api.mail.tm/* | The optional throwaway inbox. |
https://baitwall.almmity.com/* (our server) | Send a report or flag you submit, and download the public site list and report lists. |
Optional: scripting and all sites | Off by default; requested only when you turn on the scanner or paywall prompt. Runs BaitWall's own packaged scripts for the local checks. |
12. Children
BaitWall is a general-audience tool and is not directed at children under 13. It does not knowingly collect personal information from children.
13. Changes
If BaitWall's data practices change, we will update this page and its effective date before the change ships in the extension. Significant changes will also be noted in the store listing.
14. Contact
Questions or requests: contact@almmity.com. To suggest a site or correct an entry, use “Report this site” or “This is wrong” in the extension.
BaitWall is free. Optional support: Buy Me a Coffee. Donations do not unlock any feature and are not linked to any data.