This translation is provided for information only. Only the French version is legally binding.
Legal document
Browser extension privacy policy
Version 2.1 — in force since 5 November 2026
Article 1 — Purpose and scope
This policy describes the Personal Data processed when the Extension is used, the permissions it asks the browser for and the rights available to Users. It supplements the personal data protection policy, which applies to the whole Service.
The Extension is published by AXO-LAB, which releases it in its own name, as publisher, in the extension catalogues of browser vendors. Like the whole Service, it is the joint property of the Rights Holders, under the conditions set out in the legal notice. Recto is a project by Malcolm Chevillot, Lucas Firmin, Sacha Lamour and Clément Pandreau. Published by AXO-LAB.
Article 2 — Definitions
In this document, the following capitalised terms have the meaning given below, in the singular as in the plural:
- “Publisher”
- the company AXO-LAB, single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, which publishes and operates the Site and the Service under a non-exclusive licence granted by the Rights Holders. The Publisher does not hold the intellectual property rights in the Service.
- “Rights Holders”
- Malcolm Chevillot, Lucas Firmin, Sacha Lamour and Clément Pandreau, the authors of the Service, who jointly hold the intellectual property rights in it in equal shares, under a co-ownership and operating agreement.
- “Service”
- the information service named “Recto”, available through the Site and the Extension, which presents, for each news website, a Card made up of Facts.
- “Extension”
- the web browser extension published by the Publisher under the name “Recto”.
- “User”
- any person who accesses the Service, in whatever capacity.
- “Card”
- the record that the Service devotes to a news website, bringing together the Facts about it.
- “Personal Data”
- any information relating to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR.
- “Processing”
- any operation performed on Personal Data, such as collection, storage, consultation, disclosure or erasure, within the meaning of Article 4(2) of the GDPR.
- “GDPR”
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Article 3 — Controller
The controller is the company that publishes the Extension, AXO-LAB, a single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, whose registered office is at Le Point Commun, place Claude Wormser, 03000 Avermes, France. Any question about this policy, and any request to exercise rights, may be sent to the project’s contact point at contact@recto-medias.fr.
Article 4 — How the Extension works and the data processed
4.1 Icon showing the status of the website
To show the status of a website on its icon, the Extension downloads the list of websites that have a Card when it is installed, when the browser starts and then every six hours, and keeps it in the browser. On Chrome, Edge and Brave, the browser itself compares the address of the tab with this list: the Extension does not read the address. On Firefox, the Extension reads the address of each tab to compare it with this list, within the browser. In both cases, no address of a page visited is sent to the Publisher or kept.
A website is recognised under its domain name and under the host prefixes that designate the same website: “www.”, “www2.”, “m.”, “mobile.” and “amp.”. Other subdomains are not linked to the main website.
The request to download the list contains no information about the pages visited and no cookie. Like any request sent to a server, it reveals the User’s IP address, which is recorded in the server’s technical logs.
4.2 Reading on click
When the User clicks on the icon of the Extension, it accesses the address of the active tab in order to display the Card of the website visited.
4.3 Data sent
When the User clicks, the Extension takes only the domain name of the website from the address of the active tab, without the host prefixes mentioned in clause 4.1 (for example “exemple.fr”), and sends it to the application programming interface of the Service in order to display the corresponding Card. Like any request sent to a server, this transmission reveals the User’s IP address, which is recorded in the server’s technical logs. No other browsing data is sent.
4.4 Data never sent or kept
Under no circumstances does the Extension send or keep:
- the full address of the pages visited, including its path and parameters;
- the browsing history.
Under no circumstances does it read:
- the content of the pages visited;
- data entered in forms;
- the cookies of the websites visited.
Article 5 — Permissions requested from the browser
| Permission | Use |
|---|---|
| activeTab | Access the address of the active tab, only after the User clicks on the icon of the Extension, and for that tab only. |
| storage | Save the settings of the Extension and the list of websites that have a Card in the User’s browser. These data stay on the device and are not sent to the Publisher. |
| alarms | Download the list of websites that have a Card again every six hours. |
| declarativeContent | On Chrome, Edge and Brave only: let the browser compare the address of the tab with the list of websites, to change the icon. The Extension does not read the address. |
| tabs | On Firefox only: read the address of each tab to compare it with the list of websites, within the browser, and set the icon and tooltip of that tab. The address is neither sent nor kept. |
Article 6 — Purpose, legal basis and retention period
The domain name sent on click is used exclusively to display the Card of the website visited. The list of websites is used exclusively to show the status of the website open on the icon of the Extension. This Processing is based on the Publisher’s legitimate interest in providing the service requested by the User (Article 6(1)(f) of the GDPR).
The domain name is only associated with the IP address in the server’s technical logs, which are kept for twelve months at most to ensure the security of the Service. It is not used to build any profile or browsing history.
The list of websites is kept in the browser until the next download, which replaces it, or until the Extension is uninstalled.
Article 7 — Recipients
The data are intended solely for the authorised staff of the Publisher. They are hosted by OVH SAS, in France (OVHcloud data centre in Gravelines), which acts as a processor. No data are sold, rented out or disclosed to third parties for commercial or advertising purposes.
Within the Publisher, Personal Data are only accessible to authorised persons, namely the President of AXO-LAB and the members of the Recto project team, to the extent their duties require. These persons act under the authority of the Publisher, within the meaning of Article 29 of the GDPR: they only process the data on its instructions and are bound by confidentiality.
Article 8 — Rights of Users
Users have the rights provided for in Articles 15 to 22 of the GDPR, under the conditions described in the personal data protection policy, in particular the right to object to the Processing. They can stop using the Extension at any time by uninstalling it, which ends all transmission.
Article 9 — Amendments to the policy
9.1 Amendments
The Publisher may amend this policy, in particular to take account of changes to the Service, to the regulations or to case law. Each amendment gives rise to a new version, numbered and dated, published on the Site. Earlier versions remain available from the version history at the end of the document.
A new version comes into force on the date it states. Where the amendment is substantial, the Publisher informs Users by a notice on the Site and, for Users with an account, by email, before it comes into force.
Version history
| Version | Entry into force | Changes |
|---|---|---|
| 2.1 (in force) | 5 November 2026 | Launch of the Service: Cards are public, and the Extension displays those that are published. Its operation, its permissions and the data it processes are unchanged. |
| 2.0 | 29 October 2026 | Automatic icon: the icon of the Extension shows the status of the website open. The Extension downloads the list of websites that have a Card when it is installed, when the browser starts and then every six hours, and keeps it in the browser; on Chrome, Edge and Brave, the browser itself compares the address of the tab with this list, on Firefox the Extension reads the address of each tab to compare it, within the browser; no address of a page visited is sent or kept. New permissions alarms, declarativeContent (Chrome, Edge, Brave) and tabs (Firefox); usual host prefixes recognised (www., www2., m., mobile., amp.). |
| 1.1 | 23 October 2026 | Brought into line with the co-ownership and operating agreement signed on 22 October 2026: identification of the publisher of the Extension and of the Rights Holders, authors’ credit, full identification of the controller and details of the persons authorised to access the data (Article 29 of the GDPR). |
| 1.0 | Never in force | First version. |