Privacy Policy — Session Keeper for eRA Commons (unofficial)

Last updated: September 26, 2026

This extension is unofficial and is not made by, operated by, or affiliated with NIH or eRA Commons in any way. It is a small independent browser add-on that helps keep your own, already-signed-in eRA Commons session from timing out.

Who made this

Maintainer: Jeremiah Gassensmith
Contact: jgassens@gmail.com

What this extension does

While it is turned on and an eRA Commons browser tab is open, it sends that page a harmless scroll signal and refreshes eligible pages after 12–14 minutes without user activity on eRA. Pages with unsaved edits or form-action URLs are skipped. It also presses eRA's own on-screen "Continue" button if a timeout warning appears. By default it also calls eRA's own keep-alive address on eRA's own site (see "The one network call" below). That is the whole job.

What data it handles

Everything below stays on your own computer, in your own browser's local storage. It is never uploaded to a server, never shared with any third party, and there is no account, sign-in, or analytics system run by the maintainer.

• Session status and timestamps — whether you appear signed in, the latest website activity time and next idle refresh time, and the last few times it nudged, refreshed, or clicked a warning. Form values are compared locally only to avoid reloading unsaved edits; those values are never recorded or transmitted.
• eRA's own timeout cookie (ERA_SESSION_TIMEOUT_COOKIE) — read only to know when eRA itself will end your session, and watched only to notice the moment eRA deletes it (which is how eRA signals that you have been logged out). For keeping you signed in, the extension only looks at this one cookie's name and expiry time. No other cookie is ever looked at unless you switch on the optional diagnostic recorder described below, and even then no cookie's value is ever stored.
• A local diagnostic log — up to 200 lines of page paths (with any query string, page fragment, or session ID stripped out), timestamps, and short event descriptions, kept only so you can see what the extension has been doing. It never records page content, form fields, or credentials of any kind.

The optional diagnostic recorder (off by default)

The popup has a switch labeled "Record everything (diagnostic)." It is off by default. It exists only to help work out what eRA's site does before its server ends a session. Only when you switch it on does the extension ask Chrome for two extra permissions: to watch network requests (webRequest), and to see nih.gov and login.gov sites. If you decline, it stays off. Switching it off stops recording and gives those permissions back.

While it is on, it records, on your computer only:

• For each request your browser makes to an nih.gov or login.gov address: the time, the site name, the page path (with any query string, page fragment, or session ID stripped out), the request method and kind, the HTTP status number, where a redirect pointed (site name and path only), any network error, and the names of cookies the server set.
• For each nih.gov or login.gov cookie that changes: its name, site, path, flags, and expiry time, the length of its value, and a short salted fingerprint that shows whether the value changed. The cookie's value itself is never stored.
• On eRA pages: when the tab is shown or hidden, when a page is shown or left, when eRA's timeout warning appears or goes away, and when the page path changes.
• The extension's own session events (signed in, signed out, eRA's server refusing a check-in).

It never records page content, form fields, query strings, request or response bodies, passwords, two-factor codes, or cookie values. It keeps at most 20,000 events, dropping the oldest. The recording is never uploaded or sent anywhere: it leaves your computer only if you press "Download recording" and choose to share the file yourself. "Clear recording" deletes it.

What it never does

• It never logs you in, and cannot log you in on your behalf.
• It never reads, stores, fills in, or transmits your username, password, two-factor code, or any other credential.
• It does not use analytics, tracking pixels, or any third-party service.
• It does not run any code that is downloaded at runtime — every script it runs ships inside the extension package itself.

The one network call

The popup has a switch labeled "Also ping eRA's server." It is on by default, and you can switch it off at any time. While it is on, the extension calls eRA's own keep-alive web address directly — the same address eRA's own page already calls on its own every 40 minutes — because eRA's server can end a session it has not heard from in about an hour even while eRA's page timer is still running. This call goes only to an https://*.era.nih.gov address that eRA itself already serves; it never goes anywhere else, and it carries nothing from the extension beyond what your browser already sends to eRA. With the switch off, no such call is made and the extension still nudges eRA's page.

How to delete your data

Everything this extension stores lives inside Chrome's per-extension local storage. Removing the extension (chrome://extensions → Remove) deletes all of it immediately. Nothing survives anywhere else, because nothing was ever sent anywhere else.

Changes to this policy

If this policy changes, the "Last updated" date at the top of this page will change with it.