Holdfast — Privacy Policy

Last updated: 13 July 2026

Holdfast is built to keep your data on your own device. In normal (individual) use, Holdfast collects no personal data, sends nothing to us or any third party, and has no analytics, trackers, or ads.

What Holdfast stores, and where

When you use Holdfast as an individual, everything it needs is stored locally on your device using the browser's chrome.storage.local API. That data never leaves your browser and is never transmitted to us. It includes:

• your blocklist (the sites you choose to block);
• your settings (cooldown length, pass length, minimum reason length);
• active cooldowns and time-boxed passes;
• your relapse log (when you unblocked a site and the reason you typed).

We — the developer — cannot see any of this. Uninstalling Holdfast removes it from your device.

We do not collect or sell data

• No personal or sensitive information is collected or transmitted to us.
• No data is sold or shared with third parties.
• No advertising, no analytics SDKs, no third-party tracking.

Permissions, and why Holdfast needs them

• Storage — to save your blocklist, settings, and history locally on your device.
• declarativeNetRequest — to redirect a site you have blocked to Holdfast's cooldown page. Holdfast defines rules; the browser enforces them without Holdfast reading your browsing.
• Alarms — to re-block a site automatically when a time-boxed pass expires, and to re-assert your rules if they are cleared.
• Host access (all sites) — required so a block can apply to any site you choose to add. Holdfast does not read, log, or transmit the pages you visit.

Optional: a Holdfast Pro account

Holdfast works fully without an account. Only if you choose to sign in (to buy or use Holdfast Pro), the extension sends your email address and password to the account server to authenticate, and periodically checks your subscription status. We store your email and subscription state; payment details are handled by Stripe and never touch our servers.

Pro cross-device sync. If you are on Pro and signed in, the extension also syncs your blocklist and settings (and your streak numbers) to the account server so they follow you across your devices. Your browsing, your relapse history, and the reasons you type are never uploaded — they stay on each device. Without an account (the free plan), nothing syncs and everything stays local. Unlinking your account in Settings stops all account communication.

Optional: an accountability partner. If you choose to add one, you give us your email, your partner's name and email, and the events you opt into. Your partner is emailed only for those events — an intro when you add them, and a heads-up if you remove Holdfast or pass your weekly unblock limit. We never share what you browse or the sites on your blocklist with your partner — only that an event happened. Remove the partner in Settings to stop it. Emails are sent via our email provider.

Optional: managed (team) mode

Holdfast can optionally be enrolled into an organization's own "Holdfast for Teams" server by an administrator (or by your own choice). Only if you enrol, and only then, the extension communicates with the server URL your administrator configures — to fetch the policy set by your admin and to report blocked-attempt counts for compliance. That server is operated by your organization, under your organization's own privacy terms, not by us. If you never enrol in a team, none of this applies and Holdfast stays fully local.

Changes

If this policy changes, the "last updated" date above will change. Material changes will be noted in the extension's store listing.

Who operates Holdfast

Holdfast is operated by THRYVE HOLDINGS PTY LTD. See also our Terms of Service and Refund & Cancellation Policy.

Contact

Questions about privacy? Email support@holdfastblocker.com.