KPDB

KPDB Extension Privacy Policy

Last updated: August 26, 2026

Purpose of the extension

KPDB Extension displays ratings, information about movies, series, and people, as well as availability links on supported websites. To do this, the extension recognizes the current supported page and requests the corresponding data from the KPDB API.

Data processed locally

The extension stores user settings, a random installation identifier, a short-lived access token, and the installation private key on the device. The private key is created by the browser, stored in IndexedDB, and is never transmitted to KPDB. The exact address of the current tab may be stored temporarily in the extension's session storage to prevent stale responses during navigation. This state is limited to the tab and browser session and is not turned into browsing history.

Data sent to KPDB

When a supported page is open, the extension sends the following to the KPDB API:

  • the minimized address of that page;
  • a random installation identifier and the extension identifier;
  • the extension version;
  • the public key when registering the installation;
  • technical signature, access-token, and replay-protection data.

As with any HTTPS request, the infrastructure receives network data including the IP address, request time, User-Agent, and requested API endpoint. The extension does not send KPDB the page DOM or text, cookies, form data, website localStorage, account names, screenshots, or arbitrary browsing history.

URL minimization

Before transmission, the extension removes query parameters and fragments that are not needed to identify the item. Advertising, analytics, and tracking markers are not intended to be transmitted. For specific supported pages, only the required identifying parameter is retained: rt for Kinopoisk HD, list for a YouTube playlist, or key in a Plex address. The API repeats this cleanup as an additional safeguard.

Purposes of processing

Data is used only to identify an item and provide the UI, authenticate an installation, prevent abuse, maintain security, perform operational diagnostics, and measure core-feature reliability using de-identified aggregate counters.

Storage and retention

  • The supported page address is used during the /v2/extension/resolve request and is not stored in the database, extension analytics, or other durable records.
  • An access token lasts 15 minutes; a signature nonce lasts 5 minutes; short-lived rate-limit records last no longer than their applicable window, up to one hour. Rate limiting uses a SHA-256-derived IP token rather than the raw IP address.
  • The installation identifier, extension ID, version, status, timestamps, and total request counter are deleted after approximately 12 months without activity. The server-side public key has the same sliding retention period.
  • Standard application, Nginx access, and error logs are retained for no more than 14 days and may include IP address, API endpoint, Referer, User-Agent, response status, and request time. The /v2/extension/resolve body, Authorization header, and request signature are not written to these logs.
  • Daily de-identified aggregates of installations, successful and unsuccessful resolutions, and result types do not contain an installation ID, IP address, URL, host, project or person ID, User-Agent, or fingerprint and may be retained indefinitely.

Sharing with third parties

KPDB does not sell data or share browsing activity with advertising platforms or data brokers. The hosting infrastructure provider processes encrypted traffic and standard network metadata as necessary to operate and secure the service. The extension runtime loads API data, images, and platform assets only from KPDB-controlled domains; original image CDNs do not receive extension requests.

What we do not do

We do not collect browsing history, create advertising profiles, use data for personalized advertising, credit scoring, data brokerage, or unrelated market research, or allow humans to read browsing data except when required for security or compliance with law.

Security and user controls

Data is transmitted only over HTTPS. Each installation uses a separate ECDSA key pair and short-lived access tokens. The private key remains on the device. The extension can be disabled or removed; removal stops new requests and deletes local extension storage. The server does not receive an automatic uninstall notice, so inactive installation metadata is deleted according to the retention period above.

Chrome Web Store Limited Use

KPDB Extension's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only as necessary for the extension's disclosed single purpose and related security and reliability operations.