NVX_SESSION
Transparency

Everything it can collect

Telemetry is off until you turn it on. When it is on, this is the complete set of things that can be sent, and there is nothing else it is capable of sending.

Last updated 21 August 2026

Why this list is short

The format is a closed allowlist rather than a blocklist. Every field is either a fixed choice from a list or a bounded number, and there is no free-form text field anywhere in it. A URL, a domain name, a cookie or an account name cannot be transmitted even by accident, because the format has nowhere to put one.

The server enforces this a second time. Anything carrying a value not on this page is rejected rather than stored, and the database refuses it again underneath that.

The identifier

One random identifier is generated when you install the extension. It is tied to no account, no email, no device characteristic and nothing that exists outside the extension. It stays the same for that installation so that repeat visits can be counted without counting people, and it is erased when you turn telemetry off.

Events

install, update, startup
The environment block below.
active
A daily heartbeat. The environment block, plus how many sessions and tabs are in use and how long ago the extension was installed, all as ranges.
session_created
Only the resulting session count, as a range.
posture_changed
One of: mirror, standardize, persona.
feature_used
One of: bulk_move, undo_move, sign_in, context_move, key_move, release, pause.
error
One of: boot_failed, flush_failed, apply_failed, compile_failed, adopt_failed, native_failed.

The environment block

os
windows, macos, linux, chromeos, android, other
arch
x86-64, arm64, x86-32, other
browser
chrome, opera, edge, brave, vivaldi, arc, other
browser_major
A whole number, such as 128.
lang
The language subtag only, such as en. The region is stripped, because a region is closer to a location than a language preference.
tz
A whole hour offset from UTC, between -14 and 14. Not a named timezone, which would be far more identifying.

Counts, as ranges

sessions, tabs
0, 1, 2-3, 4-6, 7-12, 13+
since_install
0, 1, 2-7, 8-30, 31-90, 90+ (days)

Exact numbers are never sent. A precise count is a surprisingly good identifier, and nothing here needs one.

Never collected

Screen size and pixel ratio, canvas or WebGL output, installed fonts, the full user agent string, a named timezone, geolocation of any kind, an exact install date, exact counts, URLs, page contents, cookies, account names or email addresses.

Those first four are fingerprinting vectors. A product whose purpose is stopping sites from linking your identities has no business collecting the exact material that would let it do so.

What happens at the other end

Batches are sent to an endpoint on this domain and stored in a database only the operator can read. The request body is never written to a log. An IP address is used to rate limit and is hashed for that purpose only; it is never stored alongside the data it accompanied, so rows cannot be traced back to a network location.

There is no third-party analytics service involved, here or on this website. Adding one would contradict the product.