Huz Chrome extension security report

Supporting a creator should not cost you anything. On the Ankama store, that is exactly the case: you pay the same price, and Huz gets his share. On the Holy store, the Huz codes bring your total down on top of supporting him. Either way, you are the one who clicks. The extension prepares, you decide. And while you browse, it stops you before the fake sites that impersonate Ankama. ON THE ANKAMA STORE (store.ankama.com) You open a cart, a banner appears with the HUZ creator code already prepared. One click and it is applied. The extension never applies it on its own: without your click, nothing happens. If the code is still active when you choose your payment method, the extension leaves a temporary mark in the tab, called the support intent. It disappears as soon as you close that tab. On the order confirmation page, that mark is what counts your support exactly once. ON THE HOLY STORE (fr.holy.com, de.holy.com, uk.holy.com) On the checkout page, a module shows the two Huz codes and what each one saves you: −10 % or −5 €. You choose, the extension writes the code into the store's own discount field, and you press Holy's own "Valider" button. The extension never submits anything on your behalf. If a discount code is already applied, it stays quiet. On the thank-you page, an order carrying a Huz code counts your support exactly once. PROTECTION AGAINST FAKE SITES You know those sites that copy Ankama to harvest your credentials? The community around Huz keeps track of them. The extension downloads that banned-domain list — a simple anonymous request to huzounet.fr, refreshed about every 6 hours — and keeps it on your machine. On every navigation, it compares the page's domain name against that list. Nothing but the domain name, and entirely inside your browser. If the domain is banned, a warning page is shown before the site. You can always choose to proceed, and that choice applies to the current tab only. From the popup you can also report a suspicious site. The report is sent only when you click, and contains the page's domain name plus your optional comment. No identifier. A moderator reviews every report before anything enters the list. WHAT YOU SHOULD KNOW — AFFILIATE DISCLOSURE • The extension applies a code on your action — one click — and never automatically. • On the Ankama store, the creator code gives you no discount or price advantage: you pay exactly the same amount. It lets Ankama pass a small share of your purchase on to the creator. It is a way to support Huz, not a coupon. • On the Holy store, both codes do change the price you pay (−10 % or −5 €) and also support the creator. The extension does not tell you which to pick: it shows what each one does and leaves the choice to you. • Project approved by Huz. Unofficial extension, not affiliated with Ankama or with Holy. • If a code is already present in your cart, the extension leaves it untouched and offers nothing. PRIVACY • No tracking, no advertising, no analytics. The phishing check reads only the domain name of visited pages, locally: your browsing never leaves your browser. • Only three kinds of network requests: to store.ankama.com on your click, to apply the code and verify it is attached to the cart; to huzounet.fr to download the banned-domain list (an anonymous request, carrying no data about you); and to huzounet.fr when you voluntarily send a report (domain name + optional comment, nothing else). On the Holy store the extension sends no request at all: it writes into the page's own field and reads the page, nothing more. Nothing contained in either store's pages — cart, order, payment method — is transmitted anywhere. • The data kept persistently, all local: the last cart status, a support counter, the date of the last support, a bounded list of order fingerprints, and the local copy of the banned-domain list. Plus two temporary marks erased with the tab or session: the support intent described above, and your choice to proceed past the warning. • An order fingerprint is an anonymous anti-duplicate mark: an irreversible digest, with no items and no amount, used solely so the same order is never counted twice. • Full details in the privacy policy: https://huzounet.fr/legal/extension-privacy REQUESTED PERMISSIONS • storage: locally remembers your support counter, the anti-duplicate list and the local copy of the banned-domain list. Nothing is sent anywhere. • Access to all sites (<all_urls>): required to compare each page's domain name against the banned-domain list — a phishing site can appear on any domain, so no fixed list of sites is possible. Only the domain is read, never page content, and the comparison stays entirely local. Adding the Holy store required no new permission and no new access. • The extension only injects code on the two stores' addresses, declared separately: store.ankama.com and the Holy checkouts (fr.holy.com/checkouts/, de.holy.com/checkouts/, uk.holy.com/checkouts/). Nowhere else. • webNavigation: lets the extension observe navigations to run that local check. • alarms: schedules the periodic (≈ 6 h) refresh of the banned-domain list. • tabs: reads the active tab's address to pre-fill the popup's report form.