Privacy Policy

This Privacy Policy explains how Tri-Johnson Marketing Solutions, LLC, doing business as Legendary Leads ("we," "us," or "our"), handles information in connection with two browser extensions — Legendary Messenger CRM and Legendary Connector (each an "Extension", together the "Extensions") — and the website at crm.legendaryleads.co (the "Site"). The two Extensions do different things and handle information differently: Sections 2 and 3 describe Legendary Messenger CRM, and Sections 2b and 3b describe Legendary Connector. Read the one you have installed — and if you have both, read both. Together we call these the "Services."

By installing the Extension or using the Site, you agree to this Policy. If you do not agree, please do not use the Services.

1. The two places information lives

It is important to understand that the Extension and the Site are different, and they handle information differently.

Where	What is there	Who can see it
The Extension (your computer)	Contact records — names, profile links and avatars from conversations you have open; the pipeline stage, tags, notes and follow-up reminders you set; contact details you enter yourself (phone, email, website, business, address, plus any custom fields you add); your script, image and link libraries; the products you sell; the Facebook groups you save and any posts you note against them; and your event history and settings.	You only. This data is written to your browser’s local database on your device. It is not transmitted to us and we have no ability to access it. The one exception is entirely yours to switch on: if you connect a webhook address of your own, a contact record can be sent to that address at your direction — see Section 6. It still never comes to us.
Legendary Connector (your computer)	The Facebook groups you save; your campaigns, filters and saved keyword sets; the intro messages you write; and a record of each person you actually sent a friend request to — their name, profile link, the group they were found in, the times of the request and any reply, and which message variant was used.	You only. Written to your browser's local database on your device, not transmitted to us.
The Site and our billing systems	Your name, email address, billing details, subscription status and any support correspondence.	Us, and the service providers listed in Section 5.

2. What the Extension reads, and what it does with it

The Extension runs only on facebook.com and messenger.com. It does not run on any other website.

When you have a Messenger conversation open, the Extension reads information already displayed on that page — the conversation identifier, the other person's display name and avatar, and where available their profile link — so it can attach your own notes, stage and follow-up to the right record. Everything it keeps is written to your browser's local database and stays there.

Message text, and exactly what happens to it

To notice when someone has replied to you, the Extension has to tell a new message from one it has already seen. To do that it reads the message text visible on the page and reduces the most recent incoming message to a 32-bit fingerprint — a short number that cannot be turned back into the message. Only that number is stored, and only so that the next check can tell whether it has changed.

To be precise about it:

• The Extension reads on-screen message text in the conversation you have open, in your browser, at the moment you have it open.
• It does not store message text. Not the last message, not any message.
• The fingerprint never leaves your machine — it is not sent to us and it is not transmitted anywhere.
• Nothing about your messages is transmitted to us, stored on our servers, or used to train any model.

The Extension also reads your own first name from your Facebook account, once, so that scripts using your name fill in without you typing it into a settings box.

We do not receive your conversations. Message content, contact lists, friend lists and profile data are not transmitted to us or stored by us.

The Extension does not send messages on your behalf. When you use a script, the text is written into the Messenger compose box and the Extension stops; you review it and send it yourself.

The Extension does not collect information about people you are not already in a conversation with, and it does not read the member lists of private or closed groups.

2b. Legendary Connector — what it reads, what it sends, and what it keeps

Legendary Connector runs only on facebook.com. It does not run on any other website, including messenger.com.

What it reads

On a group's member list or a post's comments — pages you have opened yourself, in groups you have joined — it reads what is already rendered there: each person's name, their profile link, and the short lines Facebook displays about them, such as a job title, a bio line or a place. Where a person passes your filters on that basis, it opens their profile and reads the public information on it: the "Lives in" line, gender where they have made it public, and whether a friend request can be sent at all.

What it keeps — and what it deliberately does not

This is the part worth being exact about, because it is unusual:

• Nobody is stored unless a friend request was actually sent to them. Everyone else is judged in memory and dropped. The extension keeps a count of how many people were screened out and at which step, but no record of who they were.
• There is no member database, on your device or ours. The extension never assembles or exports a list of the people in a group.
• For a person you did send a request to, it stores their name, profile link, an internal key derived from that link, the group they came from, timestamps, the status of the request, and which of your message variants was used. This is what stops it requesting the same person twice and what produces your own acceptance figures.
• It stores the settings you create: saved groups, campaigns, filters, keyword sets and the intro messages you write.

All of it is written to your browser's local database on your device. None of it is transmitted to us, and we have no ability to access it.

What it sends, on your behalf

Unlike Legendary Messenger CRM, this Extension does send things — that is what it is for, and here is the full extent of it:

• Friend requests, to people who passed the filters you set, at a rate you control, after you have reviewed a list of names and confirmed twice that you want a run to start.
• One intro message to a person who accepts your request, assembled from text you wrote. The Extension ships with no message of its own.

Both actions are performed in your own browser, in your own Facebook session, by clicking the same controls you would click yourself. Nothing read during this process is transmitted to us — not the people screened, not the people requested, not the messages sent.

Information about other people

Where the Extension keeps a record of somebody you sent a request to, that record concerns a third party who has not dealt with us. It stays on your computer and we never receive it. You are the controller of that information, and you are responsible for using it lawfully — including under any marketing, privacy or data-protection rules that apply where you and the recipient are. Deleting the Extension's local data, or uninstalling it, deletes those records.

3. Browser permissions and why each one is needed

Legendary Messenger CRM requests:

Permission	Why it is requested
storage / unlimitedStorage	To keep your pipeline, scripts and settings on your device, without a size limit that would cap how many contacts you can track.
alarms	To fire your follow-up reminders at the times you set.
notifications	To show you a reminder when a follow-up comes due.
sidePanel	To display the contact record beside the conversation you have open.
clipboardWrite	So that when a picture cannot be handed to Facebook's own upload control, the Extension can put it on your clipboard for you to paste rather than losing it silently.
scripting	To place the stage labels, the launcher and the script picker into the Messenger page you have open.
Host access to facebook.com and messenger.com	To read the open conversation so your notes attach to the right person, and to place the launcher, stage labels and script picker in the interface.
Host access to identitytoolkit.googleapis.com and securetoken.googleapis.com	To sign you in and to keep your session valid. These are Google's authentication endpoints — see Section 3a.

3b. Legendary Connector's permissions

A deliberately shorter list — there is no tabs permission and no broad host pattern:

Permission	Why it is requested
storage / unlimitedStorage	To keep your groups, campaigns, filters, messages and sent-request history on your device.
alarms	So the extension's background worker can wake on a schedule to re-check that your subscription is active, and to reconcile a run after its tab has closed.
Host access to facebook.com	To read the member list or comments on the page you have open, to open a candidate's profile, and to click the friend-request control.
Host access to identitytoolkit.googleapis.com and securetoken.googleapis.com	To sign you in and keep your session valid — the same Google endpoints described in Section 3a, and the only hosts this Extension ever contacts besides Facebook itself.

3a. Signing in, and the one thing that leaves your computer

Everything above stays on your machine. Signing in is the exception, and it is worth being exact about it because it is the only moment the Extension transmits anything at all.

When you sign in, set your password or reset it, your email address and password are sent to Google — specifically to Google's Identity Platform at identitytoolkit.googleapis.com — over an encrypted connection. Google returns a token, which the Extension keeps on your device and refreshes through securetoken.googleapis.com so you are not asked to sign in again every day.

Google acts as our authentication provider. We never receive or store your password in any form: it is checked by Google, not by us. Google's handling of that information is governed by the Google Privacy Policy.

Your account exists so we can tell an active subscription from a lapsed one. Nothing about your contacts, your conversations or your pipeline is sent with it, or at any other time.

4. Information we collect through the Site

• Account and billing information. When you start a trial or subscribe, we collect your name, email address, and the billing details needed to process payment. Card numbers are entered directly into our payment processor and are never stored on our systems.
• Support correspondence. If you email or call us, we keep that correspondence so we can help you and follow up.
• Basic Site usage data. Standard web request information such as IP address, browser type and pages visited, used to keep the Site running, secure and rate-limited.
• Referral information. If you arrived through an affiliate or referral link, we record that code so the referring partner can be credited.

5. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share limited information with service providers who perform work for us and are bound to use it only for that purpose:

• Authentication — Google LLC. Google Identity Platform checks your email address and password when you sign in, and issues the token that keeps you signed in. See Section 3a.
• Payment processing — Stripe, Inc. To charge your subscription and manage trials, refunds and cancellations. Card details are entered directly into Stripe and never reach our systems.
• Hosting and infrastructure — Vercel Inc. and Cloudflare, Inc. To serve the Site and the application behind it.
• Account records — Google LLC (Firebase). To hold your account and subscription status.
• Email delivery — Brevo (Sendinblue SAS). To send receipts, account notices and support replies.

These are the only third parties that receive personal information from us. Each is bound to use it only to perform that work for us, and none of them receives anything the Extension stores on your computer.

A webhook address you connect yourself is not in this list, and that is not an oversight: it is not a provider we engaged, we do not choose it, and nothing sent to it passes through us. It is your own system, and what it does with a record is governed by your arrangement with whoever runs it. Section 6 sets out what is sent.

We may also disclose information where we are legally required to, or where necessary to protect our rights, our users, or the security of the Services.

6. Data you choose to send elsewhere

The Extension includes optional features that move data at your direction:

• Export and backup. CSV exports and JSON backups are written to your computer by your browser. Once a file leaves the Extension, protecting it is up to you.
• Import. Contacts you import from CSV are added to your local database only.
• Sending a contact to your own CRM (Legendary Messenger CRM only). If you connect a webhook address — your own CRM, or an automation service such as Zapier, Make, Pabbly or n8n — the Extension can send a contact record to that address. It goes from your computer to the address you entered. It does not come to us, and no server of ours is in the path.
  • What is sent: the person’s first and last name, email address, phone number, business, website and address as recorded on their card, their pipeline stage, their tags, and any custom fields you created — plus which event caused the send and when.
  • What is never sent: the text of any message, and the body of any note you wrote. The Extension does not store message text in the first place (Section 2), so it has none to send.
  • Nothing goes automatically unless you say so. Out of the box this is a button on a contact’s page: a record is sent when you press it, and at no other time. Two automatic triggers exist — a change to a pipeline stage you have chosen, and the first time a phone number or email address appears on a contact — and both are switched off until you turn them on.
  • The address is yours to give and to take back. The Extension asks your browser for permission to reach that one address only, at the moment you connect it, and hands the permission back when you disconnect. Only https addresses are accepted, because the record carries somebody’s name and contact details.
  • Once a record arrives, it is out of our hands and into yours. The destination is your system. Whether you may hold a given person’s details there, and for how long, is governed by the privacy and anti-spam law that applies to you — the same point made in Section 6a.

6a. Images you save, and information about other people

The image library stores the pictures you add inside your browser's local database, encoded as data. They are held locally for the same reason everything else is — it is the only way the Extension can hand a file to Facebook's own upload control later. They are not uploaded to us.

Some of what you keep in the Extension is personal information about other people — their name, their profile, and any phone number, email address or business address you record on their contact card. You are the one deciding to record it, which in most privacy regimes makes you responsible for it. Two things follow:

• Every record carries a provenance stamp — where it came from and when it was captured — written when the record is created. It exists so that if someone ever asks you what you hold about them and where you got it, you can answer.
• Whether you may keep a given person's details, and for how long, depends on the privacy and anti-spam law where you and they are. That is your call to make, not ours — see the Legal Disclaimer.

7. How long information is kept

Data in the Extension stays on your device until you delete it or uninstall the Extension. Uninstalling removes your local database, and we cannot recover it for you — take a JSON backup first if you want to keep your pipeline.

Account and billing records are kept for as long as your subscription is active and afterwards for as long as we need them for tax, accounting and legal purposes.

8. Your choices and rights

• Delete your local data at any time from the Extension's settings, or by uninstalling it.
• Access, correct or delete the account information we hold by emailing support@trijohnson.com. We will respond within the time required by applicable law.
• Cancel your subscription at any time; see the Terms of Use.
• Opt out of marketing email using the unsubscribe link in any such message. We will still send transactional messages about your account.

Depending on where you live, you may have additional rights — for example to know what personal information we hold, to request its deletion, or to be free from discrimination for exercising those rights. Contact us at the address above to exercise them.

9. Security

We use reasonable administrative and technical safeguards to protect the information we hold, and the Extension's design deliberately keeps your most sensitive data — your conversations and pipeline — off our systems entirely. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Because your pipeline lives on your computer, its security also depends on the security of that computer and your browser profile.

10. Children

The Services are intended for business use by adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

11. Where we operate

We operate from the United States and our service providers may process information there. If you use the Services from outside the United States, you understand that your information will be handled in the United States under United States law.

12. Not affiliated with Facebook or Meta

Legendary Messenger CRM is an independent product. It is not a part of, endorsed by, certified by, or affiliated with Facebook, Meta Platforms, Inc., or any of their products. FACEBOOK and MESSENGER are trademarks of their respective owners. Your use of Facebook and Messenger is governed by their own terms and privacy policies, not by this one.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date above, and for material changes we will make a reasonable effort to notify subscribers by email. Continuing to use the Services after a change means you accept the updated Policy.

14. How to reach us

Tri-Johnson Marketing Solutions, LLC
PO Box 12, Waverly, IA 50677
support@trijohnson.com
(319) 727-8500