Zen Rewards: Cashback Reminder (browser extension) Version 0.2.0 Effective date: October 21, 2026

This policy explains what the Zen Rewards: Cashback Reminder browser extension (the "Extension") stores, what it sends, and what it does not do. It applies only to the Extension. The Zen Rewards website and your Zen Rewards account are covered by the main privacy policy at https://myzenrewards.com/privacy-policy.

The Extension is published by Zen Rewards (myzenrewards.com), Phoenix, Arizona, USA. Contact: [email protected].

1. Summary

• The Extension stores a small amount of data in your browser's extension storage. None of it leaves your browser.
• The Extension sends a request to Zen Rewards in exactly three situations: when you sign in (or out) from the Extension popup, when you click "Activate cashback", and when you open the Extension popup.
• When you sign in from the popup, your email address, password and (if your account uses two-step verification) your verification code are sent over HTTPS to myzenrewards.com only, to sign you in. The Extension does not store them.
• The Extension uses no analytics SDK, loads no third-party scripts, shows no ads, and never sells or shares data with anyone.
• Uninstalling the Extension deletes everything it stored.

2. Data stored locally in your browser

The Extension uses the browser's chrome.storage area. This data stays on your device. It is not synced to Zen Rewards. The complete list:

Item	What it is	Why
Partner store list	The public list of about 1,100 Zen Rewards partner stores: domain, store name, logo URL, cashback rate text. Refreshed every 6 hours.	To know which pages are partner stores and what rate to show.
Activation timestamps	For each store domain where you clicked Activate: the time you clicked. Kept for 24 hours.	So the reminder does not nag you again on that store for 24 hours. Cosmetic only.
Snooze timestamps	For each store domain where you clicked "Not now" or "Don't show for this store": the time and the choice.	To honour your choice.
Backend setting	Whether the Extension talks to the production or staging Zen Rewards API. Defaults to production.	Development and testing.
Reminder setting	Whether the reminder card is on or off.	Your preference.
Sign-in status	Whether you are signed in, and if so your first name, membership type and cashback totals as last reported by Zen Rewards. Kept in the browser's session storage for up to 5 minutes and cleared when the browser closes.	So the popup opens without a request every time.

That is the full list. The Extension does not store your browsing history, the pages you visit, search terms, form input, passwords, payment details, or page content. The email address and password you enter in the Extension's own sign-in form are held in memory only while the sign-in request is in flight and are never written to storage.

3. Data sent to Zen Rewards, and when

3a. When you sign in from the popup

The popup has a sign-in form. When you submit it, the Extension sends your email address and password over HTTPS to https://api.myzenrewards.com/ext/login. If your Zen Rewards account uses two-step verification, the popup then asks for your verification code (or a recovery code) and sends it to https://api.myzenrewards.com/ext/verify-2fa. These are the same checks the myzenrewards.com sign-in page performs; sign-in attempts are recorded in your Zen Rewards account's sign-in history under the main privacy policy.

What Zen Rewards receives: your email address, password and verification code, plus the ordinary data any web request carries (IP address, browser user agent). The response signs you in to myzenrewards.com in this browser: the browser stores the ordinary myzenrewards.com session cookie from that response on its own, exactly as it would after signing in on the website. The Extension never reads, stores or modifies that cookie, and never stores your email address, password or code. "Keep me signed in" asks Zen Rewards for the same long-lived sign-in the website offers; the Extension stores nothing extra for it.

"Sign out" in the popup sends a request to https://api.myzenrewards.com/ext/logout, which ends that session. Because it is the ordinary site session, this also signs you out of myzenrewards.com in this browser.

3b. When you click "Activate cashback"

The Extension navigates your current tab to https://myzenrewards.com/eout/store/{id}, where {id} is the Zen Rewards store ID. This is the same tracked link you would use by clicking the store on myzenrewards.com.

What Zen Rewards receives: the store ID, and the ordinary data any web request carries (your IP address, browser user agent, and, if you are signed in to myzenrewards.com, your existing session cookie, which your browser sends on its own). Zen Rewards records this click against your account so cashback can be matched to it. The page then redirects you through the affiliate network link to the store.

The Extension does not read, set or modify that session cookie. It has no cookie permission.

3c. When you open the Extension popup

The popup calls https://api.myzenrewards.com/ext/me. Your browser attaches your existing myzenrewards.com session cookie if you have one (from signing in on the website or from the popup). The response tells the popup whether you are signed in and, if so, your name and your pending, confirmed and paid cashback totals, so it can display them.

What Zen Rewards receives: the ordinary request data (IP address, user agent, session cookie sent by the browser). Nothing from the page you are on is included.

3d. Store list refresh

Every 6 hours the Extension downloads the public partner store list from the Zen Rewards API. This request carries no account information and is the same for every user.

3e. Content script report

When a partner store page finishes loading, the Extension's content script reports the page's document.referrer value to the Extension's own service worker inside your browser. This is used only to decide whether to stand down (see the stand-down policy). This value is not sent to Zen Rewards or anywhere else. It is used in memory and discarded.

4. What is not collected

The Extension does not collect, store or transmit:

• Browsing history or a list of sites you visit.
• Page content, product names, prices, cart or checkout contents.
• Search queries. The Extension does not run on search engine result pages.
• Form input, passwords, or payment information from any web page. The only password the Extension ever handles is the one you type into its own sign-in form, which is sent to Zen Rewards to sign you in and is not stored (section 3a).
• Cookies. The Extension has no cookie permission and never reads, sets or modifies cookies. The session cookie that results from signing in is stored and sent by the browser itself.
• Precise location.
• Device identifiers beyond what a normal web request to Zen Rewards carries (IP address and user agent).
• Any data about pages that are not partner store domains. The content script is only injected on partner store domains.

No analytics, telemetry or crash-reporting SDK is included. No third-party scripts are loaded. Zen Rewards does not sell personal data, and does not share it with third parties for advertising.

5. Chrome Web Store limited use disclosure

The use and transfer to any other party of information received from Google APIs by this Extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In plain terms: the Extension only uses the data described above to provide the cashback reminder and activation feature that users see. It does not use that data for advertising, does not sell it, does not transfer it to data brokers or information resellers, and does not let humans read it except as needed for security, to comply with the law, or with your consent.

6. Retention

• In your browser: the store list is replaced every 6 hours. Activation flags expire after 24 hours. Snooze choices and settings persist until you change them or uninstall. The sign-in status cache lasts at most 5 minutes and is cleared when the browser closes. The myzenrewards.com session cookie set when you sign in is the browser's own and follows the website's session lifetime; signing out from the popup or the website ends it.
• At Zen Rewards: the click-out record made when you click Activate, and each sign-in attempt made from the popup, are kept as part of your Zen Rewards account history, under the main privacy policy. The sign-in status request is not logged beyond normal server request logs.

7. Uninstalling

Remove the Extension through your browser's extension management page (chrome://extensions or edge://extensions). Standard uninstall removes all data the Extension stored locally. The Extension installs no other software and leaves nothing behind.

Uninstalling does not delete your Zen Rewards account. To manage or delete your account, use the account settings on myzenrewards.com or email [email protected].

8. Children

The Extension is not intended for anyone under 18 years of age. Zen Rewards membership requires you to be 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has installed the Extension, email [email protected] and we will help remove any related data.

9. Permissions the Extension asks for

For transparency, the browser permissions and why each is needed:

• storage: to keep the store list, timestamps and settings described in section 2.
• tabs: to know when a tab finishes loading and what its domain is, so the Extension can decide whether the page is a partner store, and to navigate your tab when you click Activate.
• alarms: to schedule the 6-hour store list refresh.
• scripting: to inject the reminder card on partner store pages only.
• host permission for http and https pages: the partner list has about 1,100 domains and changes, so the Extension cannot list them individually in the manifest. The content script is still injected only on domains that match the partner list.

10. Changes to this policy

If this policy changes, the version and effective date at the top will change, and the new version will be published at https://myzenrewards.com/extension/privacy-policy and in the Extension's repository. Material changes will also be noted on the Extension's store listing.

11. Contact

Zen Rewards Phoenix, Arizona, USA Email: [email protected] Main privacy policy: https://myzenrewards.com/privacy-policy