Doppelgänger Privacy Policy
Last Updated: 28 October 2026
Doppelgänger is a browser extension, published by IdenHQ, Inc. ("Iden"), that warns you when a website's address is disguised with lookalike characters, flags addresses that use special characters, and marks links with such addresses before you click them. It works entirely on your device. It makes no network requests of its own, and no data it handles is sent to Iden or to anyone else.
This policy covers only the extension. Iden's websites and identity platform are covered by the Iden Privacy Policy. The extension shares no data with them.
What the extension handles
| Data | What it is used for | Where it is kept | How long |
|---|---|---|---|
| Addresses of the pages and frames you open | Checked on your device against data built into the extension (Unicode's table of lookalike characters and a list of popular domains) and the sites you sign in to, to decide whether to block the page or show a banner | Not stored | Discarded after the check |
| The address and visible text of each link on the pages you open | Checked on your device the same way, to mark links that lead to a lookalike or disguised address, or whose text names a different site than the one they open | Not stored | Discarded after the check |
| The domain of each HTTPS site where you type into a password field, on a visit you started by typing its address or opening a bookmark | Catching lookalikes of the sites you sign in to | Your browser's extension storage (chrome.storage.local), on your device | Until you uninstall the extension, or answer that a site it collides with is yours instead |
| For each open tab, the site it is on and whether you reached it by typing the address or a bookmark | Deciding whether a sign-in may teach a site: one reached by clicking a link never does | Your browser's in-memory session storage (chrome.storage.session) | Until the tab or the browser closes |
| Hosts you chose to visit with "Continue anyway" | Not showing the warning again for that host during the session | Your browser's in-memory session storage (chrome.storage.session) | Until the browser closes |
| Hosts whose special-characters banner you dismissed | Not showing that banner again for that host during the session | Your browser's in-memory session storage (chrome.storage.session) | Until the browser closes |
The extension notices that a password field received input. It never reads, stores or transmits what you type.
What the extension does not do
- It does not send data off your device, and it has no server.
- It does not sell, rent or share data with anyone.
- It does not use data for advertising, profiling, creditworthiness or any purpose other than the warnings and banners described above.
- It reads nothing on a page except the address and visible text of its links, and whether a password field received input.
- It never marks or changes links in something you are writing, such as an email draft.
The use of information received by this extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Your control
Uninstalling the extension deletes everything it stored. The session lists clear whenever the browser closes. When a site you open reads the same as one you've signed in to, the warning page asks which one is yours, and your answer replaces the stored domain.
Contact
Questions about this policy: support@idenhq.com
Changes
If this policy changes, the new version will be posted at this address with a new Last Updated date.