MoonPress Browser Bridge privacy policy

Updated November 4, 2026.

About this extension

MoonPress Browser Bridge is provided by Norml Studio. It connects supported GoDaddy cPanel and SiteGround hosting accounts to the MoonPress Shuttle desktop app using your existing browser sign-in. You enable the browser connection and start each hosting connection task in Shuttle.

This policy describes the extension and the connection data it exchanges with Shuttle. Your hosting provider operates its own website, sign-in and account services under its own privacy policy.

Information processed during a connection

The extension reads relevant hosting-page content to discover websites and complete the requested setup. This includes hosting product types, website domains, hosting or SSH account usernames, server hostnames and ports, website folder paths, sign-in and connection status, and the available setup controls.

It processes the public SSH key and key name supplied by Shuttle, reads the matching public key or authorization status from your hosting provider, and reports setup results. It reads existing public-key names and authorization status to locate the key associated with your task. Public keys are authentication-related information, but they are not private SSH keys.

It also processes the URLs of its dedicated setup tabs, the cPanel session identifier in a setup URL, and the SiteGround Site Tools site identifier to keep actions bound to the intended account and website. These session and tab details are used inside the browser; they are not included in the structured connection results sent to Shuttle.

Shuttle supplies workspace, hosting-connection and task identifiers. The extension uses them, along with temporary tab and request identifiers, to associate commands and results with the active task. Status and error messages report whether a supported setup action could be completed.

This is limited access to website content, account identifiers, authentication-related information and browsing activity associated with the requested hosting connection. The extension does not read your Chrome browsing-history database or build a history of unrelated browsing.

How information is used and shared

The extension uses this information to identify eligible hosting products and websites, open the appropriate control panel, enable supported SSH access, install or authorize the public key for your selected website, and report the result.

Structured website, server, account-username, public-key and setup-result data are exchanged with the installed Shuttle app through Chrome native messaging on your computer. Shuttle sends the connection metadata and public-key details needed to its cloud service to save and verify the authorized hosting connection. The extension itself does not send those results to a separate extension backend or an advertising service.

Your hosting provider receives the setup requests and public key needed to perform the requested actions. The provider continues to handle its own session, account and request records. Normal provider requests use HTTPS; the extension-to-Shuttle connection uses local native messaging.

We use extension data for the hosting connection functionality described here. We do not sell it, use or transfer it for advertising, use it for creditworthiness or lending, or transfer it for purposes unrelated to this functionality. Our use of extension data follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Passwords, cookies and other information

You enter provider passwords and complete MFA or CAPTCHA on the provider’s own pages. The extension does not read password-field values, access your password manager, copy your browser profile, or export password or cookie values to Shuttle.

Existing authentication is used within the provider tab. For cPanel requests, the browser supplies the same-origin session cookies and the extension uses the current session URL. This does not mean that cookie values or the cPanel session identifier are sent to Shuttle.

Private SSH keys do not enter the extension. It handles only the public key supplied for the task. It contains no advertising or analytics tracking and does not record your general clicks, keystrokes, mouse movements or scrolling. Its fixed scripts operate the controls required for the connection task.

Permissions and code

Host access is limited by the manifest to https://*.godaddy.com/*, https://*.secureserver.net/*, https://login.siteground.com/*, https://my.siteground.com/* and https://tools.siteground.com/*. Task execution is further restricted to the dedicated setup tabs and the selected website.

The scripting permission runs the extension’s bundled provider adapters. Native messaging communicates with the installed Shuttle companion. Local storage remembers your browser-connection enable/disable choice. Alarms retry the enabled local connection when Shuttle becomes available.

Executable extension code is bundled with the extension; it does not download remote code for execution. Chrome manages Store updates. For unpacked previews, an idle check reads only the extension’s own local package metadata and can reload a package already updated by Shuttle.

Storage and retention

The extension persistently stores only the browserConnectionEnabled preference in chrome.storage.local. Hosting task data, account usernames, server metadata, public keys, session details and task identifiers are not written to extension storage. Active task state is held in memory and discarded when the task stops, the connection disconnects or the extension worker ends. Requests are subject to a bounded task lifetime; an app or browser restart does not resume an earlier hosting task.

The enable/disable preference remains until changed or the extension’s local data is removed. Removing the extension removes its extension storage. Your provider’s cookies and browser history are separate browser data; the extension does not erase them.

Saved connections in Shuttle’s cloud service and keys installed with your hosting provider have separate lifetimes. Disabling or uninstalling Browser Bridge does not delete those connections or revoke an installed public key. This policy does not promise an automatic deletion deadline for those separate records.

Your controls and deletion requests

Use Disable browser connection in the popup to stop the local connection and prevent automatic reconnection. Stopping closes setup tabs owned by the extension. An action already accepted by the provider may have completed before cancellation.

You can remove the extension through Chrome. Manage or revoke an installed SSH key through your hosting provider, and manage saved hosting connections in Shuttle. To request access to, correction of or deletion of saved connection data held by Norml Studio, contact maxtymosh@norml.studio. Do not email passwords, cookies or private keys.

Contact and policy updates

Contact Norml Studio at maxtymosh@norml.studio about Browser Bridge privacy or saved connection data. We will update this policy when the extension’s data handling changes. The date above identifies the current policy.