Authorized Session Evidence Collector

These Terms of Use govern Authorized Session Evidence Collector (the “Extension”), published by Sandstorm Cyber Inc. (“Sandstorm,” “we,” or “us”). By installing or using the Extension, you agree to these terms. If you do not agree, do not install or use it. For questions, contact [dev@sandstormcyber[.]com.]

1. License and purchase

We grant you a limited, personal, non-exclusive, non-transferable license to install and use the Extension for lawful purposes, subject to these terms. The free tier includes token capture, individual-value copying, JWT summary information, and the expiry countdown. A one-time Pro purchase unlocks full JWT header and claims inspection and JSON evidence export. The current price, currency, and any applicable charges are presented at checkout. The Pro plan does not renew automatically, it is a onetime unlock.

The Extension uses ExtensionPay to check paid status and to open checkout. Payment processing, receipts, and payment-account records are handled by ExtensionPay and its payment processor under their terms and privacy notices. We do not receive your full card number through the Extension.

2. Authorized use and your responsibilities

Use the Extension only on systems, accounts, and data for which you have permission and a legitimate assessment purpose. You are responsible for obtaining authorization, following the engagement scope and applicable law, protecting collected values, and deleting or revoking evidence when required by your rules of engagement.

Do not use the Extension to access another person’s account or system without authorization, bypass access controls, intercept data unlawfully, or use captured credentials to impersonate a person. Do not upload or share captured values through public tickets, chat, email, or reports unless the recipient and channel are approved for secrets.

3. Functionality and limitations

The Extension observes selected-tab network request metadata and, when you separately request a snapshot and grant host access, reads accessible cookies and Web Storage for the current page. It does not capture request bodies. Chrome may prevent access to some pages, data, or cookies.

Token detection, names, categories, confidence scores, and JWT summary fields are heuristic. JWT decoding does not validate a signature or establish issuer trust, intended audience, authorization, integrity, or current validity. The Extension may miss credentials, produce false positives, or stop working after changes to Chrome or a target application. You must independently verify results before relying on them.

4. Sensitive information and privacy

Captured authentication material can grant access to accounts or systems. You control when to start capture, when to request a storage snapshot, whether to reveal values, and whether to copy or export them. Captured network values are held in Chrome session storage; a storage snapshot is handled in the popup. Copies and exports leave the

Extension’s control and are your responsibility.

The Extension does not send captured authentication values, page storage values, or request bodies to Sandstorm. License checks and checkout use ExtensionPay; see the Privacy Notice and ExtensionPay’s own privacy information for details. Do not use the Extension with information you are not authorized to access or process.

5. One-time purchase, refunds, and support

Pro is a one-time purchase, not a subscription. Refund requests may be sent to [dev@sandstormcyber[.]com.] with the ExtensionPay transaction reference; we will review them under the refund terms shown at checkout and applicable law. Nothing in these terms removes a cancellation, refund, or other remedy that applicable law makes mandatory.

We do not promise a particular response time or provide consulting, incident response, or assessment services through the Extension purchase.

6. Third-party services and browser platform

The Extension depends on Chrome and ExtensionPay, and checkout relies on ExtensionPay’s payment processor. Their availability, policies, and services are outside our control. Your use of those services may be subject to their separate terms. We are not responsible for outages or changes to third-party services except to the extent applicable law does not permit that limitation.

7. Updates and availability

We may maintain, update, change, or discontinue the Extension or a feature. We will not charge a recurring fee for the one-time Pro plan. We do not promise indefinite availability, compatibility with every website, or continued operation of third-party services. Where applicable law requires notice, refunds, continued access, or another remedy following a material change or discontinuation, we will follow that law.

8. “As is” terms and legal rights

To the fullest extent permitted by applicable law, the Extension is provided “as is” and “as available,” without express warranties or guarantees that it will be error-free, uninterrupted, accurate, or fit for a specific assessment. This does not exclude a representation we have made that is binding by law, nor does it waive any consumer protection, statutory warranty, cancellation, or other right that cannot legally be excluded or limited. If you are a Québec consumer, statutory legal warranties may apply despite the “as is” wording.

9. Liability

To the fullest extent permitted by applicable law, Sandstorm is not liable for indirect, incidental, special, punitive, or consequential losses, loss of profits, loss of data, interruption, or unauthorized access resulting from your handling of captured credentials or use of the Extension. To the fullest extent permitted by law, Sandstorm’s total liability for claims relating to the Extension will not exceed the amount you paid for Pro in the 12 months before the event giving rise to the claim.

These limits do not apply where prohibited by law, including liability that cannot legally be limited, or to remedies that applicable consumer law preserves. They do not make you responsible for losses caused by a party where the law says that responsibility cannot be transferred to you.

10. Suspension and termination

Your license ends if you stop using or uninstall the Extension. We may suspend access where reasonably necessary to address misuse, security risks, fraud, or legal requirements. We will provide notice where reasonably practicable and where notice is permitted. Any refund or other remedy required by law remains available.

11. Governing law and consumer rights

These terms are governed by the laws of Québec and the applicable laws of Canada, without removing mandatory consumer protections or dispute rights that apply where you live. Québec consumer rights, including statutory rights relating to the language and contents of consumer contracts, are not waived by these terms.

12. Changes and contact

We may revise these terms for future use. For material changes, we will provide notice in the Extension, on the product page, or by another reasonable method before the change applies where required by law. The version and effective date will be shown above. Questions or legal notices: [dev@sandstormcyber[.]com.]

Privacy Notice

Effective date: October 12, 2026
Publisher: Sandstorm Cyber Inc.

This notice describes the information handled by Authorized Session Evidence Collector. It should be published at a public URL and kept consistent with the Extension’s actual behavior and the privacy disclosures in the Chrome Web Store Developer Dashboard.

Information the Extension handles

When you select Start capture, the Extension may read authentication and token-like values from request headers, query parameters, and cookie headers observed for the selected tab. It also records associated request context such as source, URL, method, and how often a value appeared so you can review the result.

When you grant optional host access and select Snapshot, the Extension may read cookies available through Chrome, including cookie values and security attributes, plus document.cookie, localStorage, and sessionStorage for the current page. Some cookies and browser pages may be inaccessible. If a value is a JWT, the Extension decodes its header and claims locally to show summary information and expiry. It does not capture request bodies.

These values may contain authentication information, personal information, or confidential business data. You should use the Extension only with authorized accounts and assessment targets.

How information is used and stored

The Extension processes captured values locally in your browser to display, classify, copy, and—if Pro is active—export evidence. Network capture state is held in Chrome’s session-only extension storage. A storage snapshot is held in the popup while it is open. Copying or exporting creates a copy controlled by you and by the destination application or file system. Clear collected values in the Extension and securely handle any copies you make.

Sandstorm does not receive or store captured tokens, cookie values, Web Storage values, page contents, or request bodies. The Extension does not use those values for advertising, profiling, analytics, or sale.

ExtensionPay and checkout information

The Extension contacts ExtensionPay to check whether Pro is active and opens an ExtensionPay-hosted payment flow when you choose to purchase. ExtensionPay states that it collects an email address when a user pays and uses Stripe for payment information; ExtensionPay says it does not store credit-card numbers on its own servers. Sandstorm does not receive your full card number through the Extension. ExtensionPay and Stripe handle payment and account information under their own privacy notices and retention practices. Review ExtensionPay and Stripe Privacy Center before checkout.

Sharing and disclosure

Sandstorm does not sell or share captured assessment data. Captured values remain in your browser unless you copy, export, or otherwise disclose them. Billing and license information is handled by ExtensionPay and its payment processor. We may disclose information if required by law, but the Extension is not designed to transmit captured assessment evidence to us.

Retention and security

Session storage is controlled by Chrome and is intended to be temporary; it is cleared when the browser session ends or when you clear the captured data. Popup snapshots are temporary to that popup session. Exported files, clipboard contents, screenshots, and other copies are outside the Extension’s control. Protect them as credentials, use encrypted approved evidence storage, and revoke assessment sessions when finished.

No browser extension can guarantee that every local device, clipboard, backup, or exported file is secure. Use the Extension on a trusted device and do not reveal or export secrets unless your assessment requires it.

Your choices and permissions

Capture starts only after you select Start capture. A storage snapshot requires a separate action and optional access to the current host. You can stop capture, clear collected values, decline host access, uninstall the Extension, or avoid using it. Declining a permission means the related collection feature will not work.

Chrome Web Store Limited Use statement

The use of information received from Chrome APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Confidentialité