Privacy Policy
This policy explains what the Password Manager Extension does with your data. It covers the browser extension only. The account service the extension signs in to and stores your vault on is operated separately and has its own policy.
1. Data the extension handles
Vault data
The entries you choose to save: logins (site, username, password), payment cards (number, cardholder name, expiry, security code) and identities (name, email address, phone number, postal address). These are stored in your account on the service, not in the extension. They are encrypted under your account key and are readable only while your vault is unlocked.
Sign-in tokens
After you sign in, an access token and a refresh token are stored in chrome.storage.local on your device. They identify your session to the service. Signing out revokes and removes them.
Temporary data on your device
Two things are kept in chrome.storage.session, which is held in memory and cleared when the browser closes:
- A password you just typed into a site's own sign-in form, held between the submit and your answer to the "save this?" prompt. It is discarded as soon as you save or dismiss the prompt, and it is not readable by web pages.
- The list of sites you have paused autofill on, per tab. It is dropped when the tab closes.
Page content
On sites where you have granted access, a content script inspects the fields of forms on the page so it can tell whether there is somewhere to fill a login, card or identity, and to notice a password you have just typed. This inspection happens on your device. Field values are only sent anywhere when you act: choosing an entry to fill, or accepting the offer to save what you typed.
2. What the extension does not do
- No analytics, telemetry, crash reporting or usage tracking.
- No browsing history is collected, recorded or transmitted.
- No advertising, and no profiling.
- No data is sold, rented, or shared with third parties. Nothing is sent anywhere except the account service described below.
3. Where data goes
The extension talks to exactly one network endpoint: the account service's API. Everything it sends there is either an authentication request or a read or write of your own vault. There are no other network destinations, no third-party scripts and no external content loaded into the extension's pages.
4. Permissions and why they are needed
| Permission | Why |
|---|---|
storage | To keep your session tokens on your device, and to hold the temporary data described above. |
identity | To run the sign-in flow in a browser window and receive the authorization code. |
activeTab | To know which site the tab you are looking at is on, so the popup can offer the entries that match it. |
scripting | To run the autofill script on pages, once you have granted site access. |
| Site access (optional) | Not granted at install. Autofill and save prompts only work on sites after you grant access. Revoking it in chrome://extensions stops the extension touching pages at all. |
5. Safeguards built into the extension
- Cards and identities are only offered on pages served over HTTPS.
- Nothing is offered inside an iframe belonging to a different site than the page you are on.
- A saved login is only offered, and only released, on the site it was saved for.
- Pages are told which entries exist, never their values. A value is released only after you click.
- The extension's background worker holds no copy of your vault; it reads what it needs and is shut down by the browser when idle.
6. Your choices
- Pause a site. Turn off prompts and badges for a site in a tab, from the popup or from the save prompt.
- Withdraw site access. Remove the extension's access to sites at any time in
chrome://extensions. - Delete entries. Remove any vault entry, or any field of one, from the vault editor.
- Sign out. Ends the session, revokes both tokens and clears them from your device.
- Uninstall. Removes everything the extension stored locally. Vault data in your account is unaffected; delete it through your account.
7. Retention
Vault entries are kept until you delete them, or until you delete your account. Session tokens last until they expire or you sign out. Temporary page data does not outlive the browser session, and usually not the minute.
8. Children
The extension is not directed at children under 13 and is not knowingly used to collect their data.
9. Changes to this policy
If this policy changes, the updated version will be published with a new effective date, and the extension listing will link to it.
10. Contact
Questions about this policy or about data held in your account: semiu@live.com.