Privacy Policy

The extension

Detection and watermarking run entirely on your device. Your files are neither kept nor transmitted. Your settings stay in your browser’s storage (chrome.storage), including the per-site rules you set yourself (sites where Fili stays off, webmail sites), synced with your browser profile.

The ledger. Fili keeps on your device a record of what you watermark: the send’s reference code, the document type detected, the purpose it named, the destination site (absent for the standalone tool), the recipient you optionally named yourself — Fili cannot infer it for a webmail send — the date, and whether it came from a page upload or the standalone tool. Nothing leaves your device without your consent: Fili has no server to send it to, and no code path that could reach one. It exists to answer a leak: if an organisation you dealt with is breached, you have proof of what you gave them, exportable as a PDF or a CSV to attach to an access request. On by default, switchable off in one click, erasable in one click, and pruned after 24 months by default — at browser startup or your next watermarked send.

Syncing the ledger across your devices. Off by default — you choose. If you switch it on, the most recent 100 entries from each of your machines are copied into your own Chrome profile, so a lost laptop does not take your evidence with it. That copying is done by Chrome as part of syncing the profile you are signed into: Fili still sends nothing anywhere, and no Fili server ever sees any of it. Each of your devices writes only its own record, so none can overwrite another’s. Switching it back off removes that device’s copy from your other machines and leaves its own ledger untouched. Erasing the ledger erases it on the device you are using and withdraws that device’s copy — it does not reach your other machines, which keep their own record until you erase them too.

The usage counter

Data: how many documents you have watermarked since the start of the month, and a random installation identifier regenerated each calendar month. Nothing else. No IP address is read or kept.

Purpose: measuring how many documents are watermarked and how many installations are active in a month. This is the “usage measurement” referred to on the site: it contains only the two items above — never the content or the name of a document, never the destination site. The aggregate total is publicly accessible; it is not displayed on the pages.

Legal basis: legitimate interest — audience measurement exempt from consent under the criteria published by the French data protection authority (CNIL). The counter is on by default and switches off in one click (Fili → Advanced settings), which erases the identifier.

Retention: the identifier, one month; counter data, two months.

The website

We value our users’ privacy. If you enter your email address on the waitlist, the site no longer collects email addresses: Fili is published on the Chrome Web Store. Addresses left before publication were used only to announce the launch, were never shared with anyone, and are deleted on request.

If you fill in the enterprise contact form on the checking page, the details you enter — organisation, name, work email and a description of what you need — are used solely to answer your enquiry, and are deleted on request. That form sends no document: the checker reads the file in your browser and does not send it anywhere.

Recipient: Cloudflare, which hosts the site, the waitlist, contact enquiries and the counter, and processes the technical logs required to deliver the service.

Your rights

Data controller: MRN Services, [email protected].

Access, rectification, erasure, restriction, objection, portability: at that same address. You may lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Contact: [email protected].