Terms

Fusebox terms of service

Last updated August 8, 2026. These Terms explain the Fusebox license, payment, external services, acceptable use, report limitations, and the responsibilities that come with using the extension.

Before you rely on a report

Fusebox is an evidence and investigation tool. It can help you ask better questions about a website, but it does not certify the website or replace your own judgment, authorization, or professional advice.

1. The service

Fusebox is a browser extension and related website-analysis service. It reads technical information from the active tab, combines local analysis with selected public lookups, and presents evidence-backed reports. An optional community contribution feature can accept minimized derived signals only after you enable it and invoke the contribution action. Fusebox is not a browser, hosting provider, security monitoring service, legal adviser, or guarantee that a website is safe, legitimate, compliant, or trustworthy.

2. Eligibility and acceptance

You may use Fusebox only if you can legally enter these Terms and your use complies with the laws and policies that apply to you. By installing, accessing, buying, or using Fusebox, you agree to these Terms and the Privacy Policy. If you use Fusebox for an organization, you represent that you can accept these Terms for that organization.

3. License and purchase

After a valid purchase, Fusebox grants you a limited, personal, non-exclusive, non-transferable license to use the extension for its intended purpose. The price, included version/update rights, and any purchase-specific conditions are shown at checkout. A license key is not an account or a transferable security token: do not publish, resell, share, or attempt to reverse-engineer it. We may refuse, suspend, or revoke a license obtained through fraud, chargeback, abuse, or material breach of these Terms.

4. Checkout and refunds

Payments may be handled by Stripe Checkout or another storefront identified at the time of purchase. The payment provider's checkout terms and privacy policy also apply to the payment transaction. Our current refund approach is described on the Support and Refunds page: try Fusebox for 14 days after purchase and contact support with your receipt if it does not help you inspect websites as advertised. An explanation is not required. Mandatory consumer rights are not limited by this section.

5. External services

Fusebox depends on independent services for DNS, domain registration, IP/ASN, historical, payment, license, and optional AI functions. Those services can change, rate-limit, block, retain, or process requests under their own terms. Their availability and accuracy are outside Fusebox's control. The exact purpose and data sent to each service are disclosed in the table below and in the Privacy Policy.

6. Acceptable use

Use Fusebox only on pages and data you are authorized to inspect. You must not use it to bypass authentication or access controls, violate a site's terms or robots directives, collect personal data without a lawful basis, overload or abuse public APIs, probe systems without permission, infringe another person's rights, or use reports to facilitate fraud, harassment, discrimination, or unlawful surveillance. You are responsible for the websites you inspect and the data you submit to any AI provider.

7. Reports, AI, and decisions

Reports are observations and heuristics based on the evidence available at the time. A website can hide, proxy, change, or misrepresent its technology. Public registration, DNS, IP, and archive data can be incomplete or wrong. AI output can be inaccurate, incomplete, or unavailable. Do not use Fusebox as the sole basis for a security, financial, employment, legal, compliance, or safety decision; verify important conclusions independently.

8. Your content and third-party rights

You keep your rights in content you inspect, prompts you write, and files or reports you export. You give Fusebox only the limited rights needed to provide the feature you invoke. You are responsible for having the rights and permissions needed to inspect, copy, export, or send that content to a provider. Third-party websites, APIs, models, and storefronts remain subject to their own licenses and terms.

9. Intellectual property

Fusebox, its software, branding, documentation, report presentation, and original content are owned by Fusebox or its licensors and are protected by applicable law. These Terms do not transfer ownership to you. You may not copy, modify, distribute, sell, lease, sublicense, or create a competing product from Fusebox except as allowed by law or by written permission.

10. Changes, availability, and termination

We may update, suspend, limit, or discontinue a feature, integration, alpha tool, or version. We may also suspend access when necessary to protect the service, comply with law, address abuse, or enforce these Terms. You may stop using Fusebox at any time. Sections that should survive termination—including payment obligations, intellectual property, disclaimers, limits of liability, and dispute-related provisions—will survive.

11. Disclaimer of warranties

To the maximum extent permitted by law, Fusebox is provided as available and without warranties of any kind, express or implied. We do not warrant that the service will be uninterrupted, error-free, secure, current, compatible with every page or browser, or accurate enough for a particular purpose. No report, support response, or marketing statement creates a warranty unless it is expressly stated in writing.

12. Limitation of liability

To the maximum extent permitted by law, Fusebox and its operator will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, data, business, goodwill, or opportunities arising from use of or inability to use the service. To the maximum extent permitted by law, the total liability for a claim relating to Fusebox will not exceed the amount you paid for Fusebox during the twelve months before the event giving rise to the claim. Nothing in these Terms excludes liability that cannot legally be excluded.

13. Contact and updates

Questions, notices, support requests, and privacy concerns can be sent to support@fusebox.dev. We may update these Terms when the product, law, or integrations change. The date at the top of this page identifies the current version. If a change materially affects your rights, we will provide notice where the law requires it.

External service register

Not every service is contacted for every report. This register is part of these Terms so the dependency and purpose are explicit:

Service	Purpose	When used
Google Public DNS (dns.google) Google Public DNS privacy	Resolve A, AAAA, MX, TXT, NS, CNAME, and SOA records, and resolve a hostname before an IP report. Data sent: The target domain and the requested DNS record type.	When a DNS or IP report runs.
RDAP.org RDAP.org privacy considerations	Retrieve domain registration data such as registrar, registration dates, status, and name servers. Data sent: The target domain.	When a WHOIS/domain report runs.
IPinfo (ipinfo.io) IPinfo privacy policy	Provide IP, ASN, network-owner, and location context for the inspected hostname. Data sent: The resolved IP address and, if supplied by the user, an IPinfo token.	When the IP/hosting report runs.
ipwho.is ipwho.is privacy policy	Provide key-free IP, network-owner, and location context when IPinfo returns nothing usable. Data sent: The resolved IP address of the inspected site.	Only when the IP report falls back from IPinfo.
RIPEstat RIPE NCC privacy statement	Provide an ASN fallback when IPinfo does not return ASN data. Data sent: The resolved IP address.	Only when the IP report needs an ASN fallback.
Team Cymru IP-to-ASN (queried over Google Public DNS) Team Cymru privacy policy	Corroborate the network owner and ASN for the inspected site's IP address. Data sent: The inspected site's resolved IP address, encoded in a DNS TXT query name answered by Team Cymru's name servers.	When the IP report enriches or corroborates ASN data.
Internet Archive Wayback Machine Internet Archive privacy information	Retrieve historical capture dates, counts, and snapshot URLs for a domain. Data sent: The target domain.	When the history report runs.
crt.sh (Sectigo certificate transparency search) Sectigo privacy policy	Retrieve certificate history, issuers, and subject alternative names published in public certificate transparency logs. Data sent: The target domain, as a wildcard certificate search query.	When the TLS/certificate report runs.
urlscan.io urlscan.io privacy policy	Retrieve the most recent public scan records and malicious/benign verdicts for the domain. Data sent: The target domain and, if supplied by the user, a urlscan.io API key.	When the urlscan report runs.
MDN HTTP Observatory (Mozilla) Mozilla privacy notice	Grade the target site's security headers. Data sent: The target hostname. Mozilla runs the scan from its own infrastructure, so the inspected site receives a request from Mozilla rather than from the user.	When the security-header grade report runs.
Cloudflare security DNS and Quad9 Cloudflare and Quad9 privacy policies	Check whether independent blocking DNS resolvers refuse to resolve the domain, as a threat-consensus signal. Data sent: The target domain.	When the threat report runs.
URLhaus (abuse.ch) abuse.ch privacy policy	Check the host against known malware-distribution URLs. Data sent: The target hostname and the user's URLhaus Auth-Key.	Only when the user has configured a URLhaus Auth-Key. Without a key the reputation report reports 'not configured' and no request is made.
Fusebox license service (Cloudflare Workers and D1) Cloudflare privacy policy	Run checkout orchestration, issue and validate licenses, and support restore/manage flows. Data sent: For validation: license key, installation ID, and extension version. For purchase: email, checkout/license records, a short campaign source code, and an optional buyer-selected source answer. Cloudflare may also receive standard request and security metadata. Settings exposes an advanced license Worker URL; if the user replaces the Fusebox default, validation data is sent to that configured endpoint instead.	When a user buys, activates, restores, or validates a Fusebox license.
Fusebox brochure page counter (Cloudflare Workers and D1) Cloudflare privacy policy	Measure an aggregate daily count of brochure page routes and bounded launch-channel codes at the edge. Data sent: A UTC day, normalized page path, and bounded campaign code. The counter does not store query strings, referrers, cookies, IP addresses, or visitor identifiers.	For brochure GET/HEAD page requests when the page counter is configured.
Fusebox self-hosted Rybbit analytics (ry.fusebox.dev) Rybbit privacy information	Measure brochure page traffic, visitor journeys, acquisition sources, device categories, approximate location, and outbound-link use. Data sent: The brochure hostname, path, full query string, page title, referrer, language, screen dimensions, and outbound-link destination, text, and target when an outbound link is clicked. The service also receives the request IP address and user agent; Rybbit uses them to derive device/browser/OS and approximate location and to generate a pseudonymous visitor identifier. The deployed tracker creates a random rybbit-visitor-id in local storage, although the current production configuration does not include that value in page-view requests.	The client script loads on fusebox.dev and www.fusebox.dev page views except /admin paths. The current public configuration enables page views, SPA navigation, query parameters, and outbound-link tracking; session replay, error tracking, web vitals, button/copy/form tracking, and feature flags are off.
Fusebox community observations (Cloudflare Workers and D1) Cloudflare privacy policy	Accept an explicit, opt-in contribution of minimized aggregate technology, hosting, tracker, security, and risk signals. Data sent: Registrable domain, observation date, extension version, normalized signal IDs, optional security grade, and the inspected site's resolved IP address. The contribution also carries a stable contributor ID derived from the local installation ID by a one-way hash, and the service records the contributor's IP address at the edge. That attribution exists so abusive contributions can be traced, removed, and blocked; it is not joined to license records and is not used to build a browsing profile. No page HTML, full URL, source, cookies, prompts, or raw network data. Community calls reuse the advanced license Worker URL, so replacing that default sends this data to the configured endpoint instead of Fusebox.	Only after the user enables community sharing and presses the contribution action for a report.
Fusebox diagnostic sessions (Cloudflare Workers) Cloudflare privacy policy	Share a short-lived, redacted diagnostic snapshot with Fusebox support or QA to reproduce a problem. Data sent: While a session is active the extension uploads, roughly every five seconds, redacted page HTML (capped per document), the report set and verdict, DOM metadata, console entries, network request summaries, the page domain and its URL with query string and fragment removed, the extension version, and a one-way hash of the installation ID. Redaction removes values that look like credentials, tokens, cookies, and API keys, and strips query strings from URLs, but it is pattern-based and cannot guarantee that every secret rendered into a page is caught. The advanced diagnostic Worker URL is user-editable (and defaults to localhost in the development configuration), so these snapshots go to the exact endpoint shown in Settings.	Only after the user reviews the Worker URL and enters a six-digit pairing code under Settings, Advanced, Admin diagnostics. The panel shows a persistent sharing indicator, the expiry time, and a stop control, and the session expires on its own.
Stripe Checkout Stripe privacy policy	Process a payment and provide payment status and receipt information to the license service. Data sent: Email, payment, and billing details entered into Stripe's hosted checkout. Fusebox does not receive full payment-card numbers.	When a purchase is completed through Fusebox checkout.
OpenAI API OpenAI business/API privacy information	Optional cloud AI for chat and narrative analysis when the user supplies an OpenAI API key. Data sent: The user's prompts and conversation, the current URL/domain, and any report or active-tab context included in the AI request.	Only when the user selects OpenAI cloud AI.
Vercel AI Gateway Vercel privacy notice	Optional gateway for cloud AI models when the user supplies a Vercel AI Gateway key. Data sent: The user's prompts and conversation, the current URL/domain, and any report or active-tab context included in the AI request. The gateway may route the request to the selected model provider.	Only when the user selects Vercel AI Gateway cloud AI.
Ollama Ollama privacy policy	Optional local AI endpoint for chat and narrative analysis when the user selects Ollama. Data sent: The user's prompts and conversation, the current URL/domain, and any report or active-tab context included in the AI request.	Only when the user enables BYO-key AI mode and selects Ollama.
LM Studio LM Studio privacy policy	Optional local AI endpoint for chat and narrative analysis when the user selects LM Studio. Data sent: The user's prompts and conversation, the current URL/domain, and any report or active-tab context included in the AI request.	Only when the user enables BYO-key AI mode and selects LM Studio.
Chrome Prompt API / Chrome model delivery Chrome Prompt API documentation	Optional on-device AI and availability or download of the browser-managed model. Data sent: Fusebox sends prompts and selected context to the browser's on-device model. Chrome may download model assets after the user consents; Fusebox does not send the report to its own server in this mode.	Only when the user enables on-device AI and Chrome makes the Prompt API available.