CookieCleaner does not collect, store, or transmit any personal data. The extension has no servers, no account system, and no telemetry: all data (list of sites, preferences, cleanup log) remains stored locally in your browser.

The only outgoing network requests are those you manually trigger in the “Leak Check” section: to haveibeenpwned.com (email check, only if you provide your own API key, stored locally) and to api.pwnedpasswords.com (anonymous password check using k-anonymity: only the first 5 characters of the SHA-1 hash are sent—never the password itself).

Complete and auditable source code: https://github.com/FrankkDarko/CookieCleaner