Isakovic Studios

SitePass Privacy Policy

Last updated: May 18, 2026

SitePass is a Chrome extension for voluntary accountability. You explicitly choose websites you want to block yourself from, and explicitly invite a trusted friend who can grant you temporary access on request. This policy explains exactly what data we collect, why, and how it is handled.

Account information

SitePass uses Amazon Cognito to authenticate users. When you create an account we store your email address and a display name. We do not store your password — Cognito handles authentication and only shares a short-lived identity token with the extension. We never see your password.

Friendships and approvals

SitePass stores records of friendships you explicitly establish with other SitePass users by sharing an invite code. Each friendship record contains the two user IDs involved, the friendship status (active or revoked), and timestamps. Either party can revoke a friendship at any time from the extension's Friends tab, which marks it revoked in our database.

Blocked sites

For each user we store the list of domains they have personally added to their block list, together with an optional reason note you can attach to remind your future self why you blocked it. No other browsing activity is recorded.

Access request events

When you attempt to visit a domain you have personally added to your block list, SitePass creates an "access request" record that contains the domain, the requesting user ID, the approving friend's user ID, a creation timestamp, and the request status (pending, approved, rejected, or expired). Pending requests expire automatically after five minutes. Decided requests are retained for up to seven days for audit purposes and are then deleted automatically via DynamoDB TTL.

SitePass does not record general browsing history. The only navigation events captured are attempts to visit domains you yourself added to your block list.

WebSocket connection identifiers

When the extension is open, it maintains a WebSocket connection to our backend so your friend can be notified of access requests in real time. The connection identifier is stored alongside your user ID and automatically deleted within two hours.

What we do not collect

Where data is stored

All server-side data is stored in encrypted Amazon DynamoDB tables in the AWS us-east-1 region, with point-in-time recovery enabled. The Cognito user pool resides in the same region. Local preferences and active grants are also stored in your browser's extension storage on your own device.

Sharing

We do not sell user data. We do not share user data with any third party. Friendship records, blocked-site lists, and access request events are visible only to the user they belong to and, where applicable, the explicitly-paired friend.

Service providers

SitePass relies on Amazon Web Services (Cognito, Lambda, API Gateway, DynamoDB) to host its backend. AWS processes the data described above on our behalf under standard service agreements and uses it only to operate the service.

Your rights and deletion

Children

SitePass is not directed to children under 13 and we do not knowingly collect personal information from them.

Changes to this policy

If we change this policy materially, we will update the "Last updated" date above and surface a notice in the SitePass dashboard on next open.

Contact

Questions, support requests, or deletion requests: petarisakoviccanada@gmail.com