Amuneth Guard protects users in Chrome and Edge against suspicious websites, phishing, credential theft, risky downloads and data leak moments. The extension is designed to assess as much as possible locally in the browser and send as little data as possible.
Guard locally assesses browser and page signals needed to recognize risk, such as URL characteristics, suspicious domain patterns, form actions, password fields, OAuth scopes, download signals, webshop signals, ClickFix/RunMRU instructions and data leak indicators. This analysis happens in the user browser.
Only when a user reports a suspicious page, or enables automatic reporting for high-risk URLs, can Guard send data to Amuneth for CTI research. This includes:
If domain age checking is enabled, Guard may query the domain name through a public RDAP service to determine whether the domain is younger than 30 days. Only the domain name is queried, not the full URL, path or query string.
Guard does not send passwords, form contents, cookies, files, payment details, personal communication or keystrokes. Amuneth Guard also does not store a source IP address for reported URLs.
Reports are used to investigate suspicious URLs, recognize phishing routes, analyze recurring campaigns and improve CTI insight. The data is not sold and is not used for advertising.
The extension uses local browser storage for settings such as risk thresholds, allowlist, blocklist, reporting endpoint, language and preferences. These settings remain local unless the user submits a report or enables automatic reporting for high-risk URLs.
Questions about this privacy policy or Amuneth Guard can be asked through the contact options on amuneth.com.
