Vinea's Security and Privacy: How a Browser Proxy Extension Handles Your Data

Vinea is a browser proxy extension built on Chrome's Manifest V3 architecture, designed around the principle of least privilege — it only requests permissions that are functionally necessary, does not read page content, does not log which sites you visit, and stores domain rules locally on your device.

Installing a browser extension means placing a degree of trust in the developer. This article is intended to make that trust verifiable: what permissions Vinea requests, what each one does, and where your data goes.

What permissions does Vinea request?

Here is the complete list of permissions Vinea requests and what each one is for:

| Permission | Purpose | |------------|---------| | proxy | Uses Chrome's Proxy Settings API to configure browser proxy settings (traffic routing for smart mode and global mode) | | storage | Stores domain rules, node selection, and mode settings locally in the browser | | activeTab | Accesses only the current tab's domain when you actively use the right-click menu to add a domain rule | | webRequest | Handles 407 authentication responses from the proxy server, automatically providing credentials | | identity | Google OAuth sign-in | | contextMenus | Registers right-click menu items ("Add to Proxy List" / "Add to Direct List") | | management | Detects whether the extension was installed from the Chrome Web Store |

Notably, Vinea does not request:

• No <all_urls>: does not request access to all websites
• No tabs: does not monitor which tabs you have open
• No history: does not access your browsing history
• No cookies: does not read cookies from any website

How the proxy works — without touching page content

Vinea uses Chrome's chrome.proxy.settings API. Here is how it works:

1. It tells the browser a proxy server address
2. It tells the browser a bypass list — which domains should connect directly
3. The browser handles the actual traffic routing

In this process, Vinea acts as a configurator, not a middleman. After setting the rules, the browser engine decides whether each request goes through the proxy or connects directly. The extension itself never handles any page request content or response data.

The webRequest permission serves exactly one purpose: when the proxy server returns HTTP 407 (authentication required), the extension reads locally stored server credentials and completes the handshake. This involves only the proxy connection itself, not page content.

What the server does not log

According to Vinea's privacy policy, server-side data handling follows these principles:

• No domain logging: the server processes domain information for routing but does not store it in any form (databases, caches, or logs)
• No IP logging: user IP addresses are not stored
• No browsing activity: the server does not know what pages you visited or what content you viewed
• Payments handled by third parties: all payments go through third-party gateways (WeChat Pay, Alipay, etc.) — Vinea does not store any payment-sensitive information

What the server does store is limited to: the email and password needed for account authentication (encrypted), and traffic usage amounts for billing.

Where domain rules are stored

Custom domain rules you add via the right-click menu (proxy list / direct list) are stored in chrome.storage.local — the browser's local storage. This means:

• Rules only apply within the browser on the current device
• Rules are not uploaded to Vinea's servers
• Rules are not synced to your other devices
• Uninstalling the extension clears these rules

What analytics data Vinea collects

Vinea uses Google Analytics to collect product usage data for understanding feature adoption and improving the product. Events include:

• Extension popup opened (popup_opened)
• User signed in successfully (signin_success)
• Trial start and purchase funnel events

Each event carries only: browser type (Chrome/Edge/Firefox), locale setting, and extension version number.

What is not collected: which sites you visit, what you search for, or what you do on any page. Product analytics focus on "how many users use a feature," not "what users are browsing."

Frequently asked questions

Does Vinea read the content of pages I visit?

No. Vinea uses Chrome's Proxy Settings API to configure browser proxy settings. This API only tells the browser which traffic goes through the proxy and which connects directly — it does not intercept or read any page content.

Does Vinea's server log which websites I visit?

No. According to Vinea's privacy policy, the server does not store visited domains or IP addresses in any form, including databases, caches, and logs.

Are my custom domain rules uploaded to the server?

No. All custom domain rules are stored in the browser's local storage (chrome.storage.local). They only work on the current device and browser, and are never synced to the server or other devices.

---

To learn how Vinea's smart routing automatically directs traffic by domain, read Smart Routing Explained.

New users get a 3-day free trial after install — setup takes about a minute.

Read the install guide ->