Privacy Policy

1. Introduction and Overview

This Privacy Policy describes how LoadLine Web Runner (part of the open-source Crossbench performance benchmarking suite) accesses, uses, stores, and protects user data when you use the application.

LoadLine Web Runner is a client-side web application designed to run browser performance benchmarks (such as LoadLine) directly within modern web browsers using WebAssembly (Pyodide) and WebUSB.

2. Google User Data Accessed and Collected

LoadLine Web Runner requests authorization via Google Identity Services (OAuth 2.0) solely to enable access to required test fixtures stored in Google Cloud Storage.

Specifically, the application interacts with the following data:

• OAuth 2.0 Scope: https://www.googleapis.com/auth/devstorage.read_only (Read-only access to Google Cloud Storage).
• Google Account Email: If authorized, the user's email address is retrieved via Google's tokeninfo endpoint solely to verify that the signed-in user has permissions to read the target Google Cloud Storage bucket and to display the active authenticated account in the user interface.
• Google Cloud Storage Objects: Read-only access to download pre-recorded website archives (Web Page Replay .wprgo archive files, such as gs://chrome-partner-loadline/...) used as deterministic test fixtures during benchmark runs.

3. Purpose and Use of Google User Data

The access to Google Cloud Storage is used for a single, specific purpose:

• Downloading Benchmark Workload Archives: The LoadLine web performance benchmark reproduces real-world web browsing scenarios using recorded web page replays. These archive files are hosted in authorized Google Cloud Storage buckets. The application uses the read-only OAuth token to authenticate direct browser downloads of these archive files so they can be replayed during local benchmark runs.

We do not use Google user data for any other purpose, including advertising, marketing, analytics, profiling, or tracking.

4. Data Storage, Retention, and Processing

LoadLine Web Runner is an entirely client-side application running in your web browser.

• No Server-Side Transmission: The application does not operate a developer backend server. OAuth tokens and downloaded files are never transmitted to, processed by, or stored on any third-party or remote servers. All API requests are sent directly from your browser to Google's official endpoints (accounts.google.com, storage.googleapis.com, and oauth2.googleapis.com).
• Local Token Storage: The temporary OAuth access token is stored locally on your device in browser localStorage (or session memory) to maintain authentication between page reloads.
• Local Archive Caching: Downloaded benchmark archive files (.wprgo) are cached locally on your device in your browser's IndexedDB storage to avoid re-downloading large archive files on subsequent benchmark runs.

5. Data Sharing and Disclosure

LoadLine Web Runner does not sell, rent, trade, license, or share any user data or Google account information with third parties.

No analytics trackers, third-party advertising SDKs, or external monitoring services are embedded in the application.

6. User Control, Data Deletion, and Revocation

You have full control over your data and authentication sessions at all times:

• Sign Out / Clear Tokens: You can click the Sign Out button in the application interface at any time. This immediately purges the stored OAuth access token and session details from your browser's localStorage.
• Delete Cached Archives: You can click the Clear Cache button in the application interface to remove all cached Google Cloud Storage archive files from your browser's IndexedDB storage.
• Revoke Account Permissions: You can revoke LoadLine Web Runner's access to your Google Account at any time by visiting your Google Account Third-Party Apps & Services Settings.
• Clear Browser Storage: Clearing your browser cookies and site data for this domain will delete all locally stored tokens, settings, and cached benchmark fixtures.

7. Google API Services User Data Policy Compliance

8. Security Safeguards

We employ industry-standard technical measures to safeguard your session and data:

• All communication with Google APIs is encrypted in transit using Transport Layer Security (HTTPS).
• Browser security headers, including Cross-Origin-Opener-Policy (COOP), are configured to isolate application execution.
• OAuth access tokens are short-lived (typically expiring within 1 hour) and are managed according to Google Identity Services best practices.

9. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Any revisions will be posted on this page with an updated Effective Date.

10. Contact Information

If you have questions, concerns, or feedback regarding this Privacy Policy or the data practices of LoadLine Web Runner, please contact the LoadLine team at:

loadline@chromium.org

You can also view the source code and documentation in the Crossbench Project Repository.