SweepPicks browser extension: privacy policy

The full SweepPicks privacy policy is at https://sweeppicks.com/privacy/. This is the part that covers the extension.

WHAT THE EXTENSION CAN ACCESS

The extension requests access to a fixed, named list of sweepstakes casino domains, and nothing else. It cannot read pages outside that list. It does not request permission to read your browsing history, your open tabs, your bookmarks, or your downloads. Every domain is listed in the manifest.

WHAT IT STORES ON YOUR DEVICE

The extension keeps the following in local extension storage, where no website can read it:

• A cached copy of our public offer catalogue, so the offer card appears without waiting for the network
• Which offer cards you dismissed and which casinos you muted
• Which daily bonuses you marked as claimed today
• A session token, only if you choose to sign in

If you never sign in, none of this leaves your device.

THE OPTIONAL ACCOUNT

Signing in is optional. Every offer and the whole daily list work without an account. If you do sign in, we receive and store:

• Your email address, which is how the sign in link reaches you. There is no password
• A record of which casino you marked claimed and on what date, so your claim history and streak stay consistent between this browser, our website and our Discord

If you link a Discord account, we also store your Discord user id, username and avatar, so the bot can recognise you and assign roles. Discord is a link on an existing SweepPicks account, never a way to sign in, and you can unlink it at any time from your account page.

WHAT IT NEVER COLLECTS

The extension does not collect your browsing history, the content of any page, your location, payment details, keystrokes, or any third party account. Marking a bonus as claimed is an action you take deliberately, and it is the only thing about your activity we ever record.

WHAT IT DOES NOT DO

The extension does not redirect you, rewrite links on the page, or replace affiliate tracking that is already present. It opens a link only when you press a button.

DELETING YOUR DATA

Signing out removes the session token from your browser. Removing the extension removes everything it kept locally. To delete your account and the claim history attached to it, email hello@sweeppicks.com and we will remove it.

AFFILIATE LINKS

When you click through to a casino, the casino may record that the visit came from SweepPicks, and may pay us a commission if you register. That tracking is performed by the casino and its affiliate network, not by us, and is governed by their privacy policies. It never changes the offer you receive.

Contact: hello@sweeppicks.com
Notes to Reviewer — this is the field that decides whether Mozilla demands a source code submission, so do not leave it empty:

NO BUILD STEP, SO NO SOURCE SUBMISSION IS NEEDED

The package contains the exact, complete source. background.js, content.js and popup.js are plain JavaScript written by hand. There is no bundler, no transpiler, no minifier and no generated code of any kind. What you read in the package is what runs.

The only generated file is manifest.json. Its host_permissions and content_scripts.matches are produced from our offer catalogue by a small script, so the permission list can never drift from the casinos we actually list. That generator writes the manifest and touches no executable code.

NO REMOTE CODE

The extension fetches one JSON document, our public offer catalogue, from https://sweeppicks-api.maj-ea4.workers.dev/catalog and renders it as data. No script, module or WebAssembly is loaded, evaluated or injected from a remote source. eval is never called. Neither popup.js nor content.js assigns to innerHTML; both build DOM nodes.

HOW TO TEST IT WITHOUT AN ACCOUNT

Everything works signed out, so no credentials are needed to review it.

1. Open the toolbar popup. The full daily bonus list appears immediately, read from the catalogue above.
2. Visit any casino in the permission list, for example https://www.chumbacasino.com/ . A card appears at the bottom right showing that casino's current offer. It is rendered inside a closed shadow root so the page cannot restyle or read it.
3. Press the claim button. The extension records the claim locally and opens the casino in a new tab. Nothing is sent anywhere while signed out.

Sign in is optional and only sends a one time link to an email address the user supplies. It uses identity.launchWebAuthFlow against our own domain, sweeppicks.com, and requests no third party OAuth scopes.

WHY THE MANIFEST DECLARES background.scripts

Firefox has no service worker background in MV3, so the Firefox package declares background.scripts. It points at the same background.js that the Chrome package runs as a service worker. The file is a classic script with no module syntax, so it runs unchanged under either model.

CONTENT

The add-on covers sweepstakes casinos, which are free to play social casinos where no purchase is ever necessary. The listing states 18+ and links to begambleaware.org. The extension shows no gambling content itself. It shows which bonus each site is currently offering.