Northlink privacy notice

Northlink browser extension

Updated November 10, 2026. This section covers the Northlink browser proxy extension.

The extension connects browser traffic through the Northlink TLS gateway after explicit account approval, or through an HTTP, HTTPS, or SOCKS5 proxy you provide. Managed access currently supports unlimited-traffic subscriptions. It does not start the Northlink application or control other applications’ connections.

Information on your device

The proxy endpoint, preferences, exclusions, check time/result, separate installation ID and Northlink session credentials are stored locally in the Chrome profile. Short-lived proxy credentials and the approval secret remain in browser-session storage. Only trusted extension contexts can access them; they are not synced or shared with web pages. A Chrome profile is not an OS credential vault, and a person with access to its files can read local data.

When you open the extension, it reads the active tab’s hostname to offer an exception. It does not read page content or collect browsing history. Passwords are not accepted for a custom proxy; the Northlink gateway uses individual short-lived credentials that never appear in the popup or routing script.

During sign-in, Northlink receives installation/OS metadata and binds the installation to a session, device and subscription for access checks and revocation. Logout revokes the server session before deleting local credentials; if the service is unavailable, credentials are retained so revocation can be retried. Removing the extension clears its local settings; use the Northlink cabinet to revoke access and release the device.

Network requests and recipients

The selected proxy operator processes routed requests subject to their own encryption. The Northlink gateway does not log visited URLs, request bodies or credentials. Local destinations, site exceptions and, in Smart mode, .ru, .su, .рф, .by and .бел domains use a direct connection. The fixed Northlink API hostname remains direct to renew or revoke access even during a proxy outage.

To check forwarding, the extension requests Cloudflare’s HTTPS trace endpoint, with ipify as an alternative. These services receive the proxy’s exit IP and normal network request metadata. The extension sends no account credentials or cookies in these checks. The returned IP is validated and discarded; only the check time and success or error are stored locally.

Checks run when connecting, when the browser starts with the proxy enabled, when you request a check, and periodically while connected. Disconnecting stops periodic checks. The extension uploads no analytics and does not sell information.

Permissions and controls

Proxy and privacy apply proxy settings and disable non-proxied WebRTC UDP when permitted by the browser. Storage saves settings and credentials, alarms schedules checks and renewal, and activeTab offers site exceptions. WebRequest and webRequestAuthProvider, with HTTP/HTTPS host access, handle browser proxy-auth challenges; credentials are supplied only to the selected Northlink TLS gateway. These permissions are not used to collect browsing history or page content.

You can change the endpoint, routing mode, and site exceptions or disconnect in the extension. A failed check retains the selected proxy until you disconnect and does not enable a direct fallback for protected destinations. Organization policies, the browser, and other extensions can restrict control of network settings; the extension reports restrictions it detects.

Contact Northlink support with questions about extension data.