Privacy
A site blocker necessarily sees every address you visit. That makes this page the most important one on the site, so it is written to be checked against what the software does rather than to reassure.
The short version
Gatesites makes no network requests. It has no server, no account, no sign-in, no sync and no analytics. Nothing it observes is transmitted anywhere, because there is nowhere for it to be transmitted to. The web fonts it draws itself with are packaged inside the download rather than fetched from a font service, so even opening a block page contacts nothing.
What it stores, and where
- Your rules
- Blocked sites, allowed sites, keywords, categories, schedules, redirect address and block page wording. Held in the browser's own extension storage on your computer.
- Statistics
- Per day, per site: how many times a site was blocked and roughly how many seconds a tab on it was the active tab. Kept for sixty days, after which the oldest day is deleted automatically. Sites are recorded by domain, never by full address, and page contents are never stored.
- The activity log
- The last three hundred events: unlocks, exceptions granted, focus sessions, settings changes and wrong password attempts, each with a timestamp. This exists so the person holding the password can see what happened. It contains domains, not full addresses.
- The password
- Never stored. What is stored is a PBKDF2-SHA256 digest over 310,000 iterations with a random 16 byte salt, which the password is checked against. The recovery code is stored the same way. Neither the password nor the code can be read back out of the extension.
What it looks at but does not keep
To decide whether to block a page, Gatesites reads the address of each top-level navigation and compares it against your rules in memory. That comparison is not written down. The full address of a blocked page is put into the block page's own address so it can be shown back to you and reopened, and it is gone when you leave that tab.
If, and only if, you mark a keyword as one to scan the page for, a small script reads the visible text of pages you open to look for that word. The text is examined in the page and discarded. It is never stored and never sent. With no such keyword set, the script asks the extension once whether it has any work and then does nothing.
Permissions, and why each one exists
- Access to all sites
- A blocker cannot know in advance which addresses you will ask it to block, so it has to be able to act on any of them.
- Reading tabs and navigation
- To see where a tab is going in time to stop it, and to attribute time to the tab you are actually looking at.
- Declarative net request
- Hands plain domain rules to Chrome itself, so a blocked page is stopped even before the extension's background worker has woken up.
- Storage
- For everything in the table above.
- Alarms and idle
- To expire timed exceptions and focus sessions, and to stop counting time when you walk away from the machine.
Other people
If you hand the password to somebody else, that person can read your block list, your statistics and your activity log on this computer. That is the point of the arrangement, and it is worth being clear-eyed that you are choosing it. They cannot see any of it remotely, and they cannot see anything at all unless they are using this browser.
The website
This site is static HTML on a server run by Noahlot. It sets no cookies and runs no analytics. The web server keeps ordinary access logs, which record the requesting address, the page requested and the time, and those are rotated in the normal way. Web fonts on this site are served by Google Fonts, which sees the request. The extension itself does not use them.
Children
Gatesites is often installed by a parent on a child's machine. Nothing about the child's browsing is collected by Noahlot, because nothing is collected at all. Everything stays on the device the parent set up.
Getting your data out, or deleting it
The Backup section of the settings page exports your rules as a file you can read. Removing the extension from the browser's extensions page deletes everything it stored, immediately and completely. There is nothing held elsewhere that would need a request to erase.
Questions
Last updated 19 August 2026. Applies to Gatesites 1.0.0.