Privacy policy

Account: your email address and an account password, handled by Firebase Authentication (Google) to sign you in.

Vault: your saved logins (name, username, password, website and notes) stored in Cloud Firestore only as AES-256 ciphertext. The encryption key is derived on your device from your master password with PBKDF2 and is never sent to us, so we cannot decrypt your vault.

Unencrypted metadata: the tags you add to items, the creation and update times of items, and a random salt and key-check value needed to derive and verify your key.

The extension runs on the pages you visit so it can find login and sign-up forms, show saved logins for that site, suggest generated passwords and offer to save logins you submit. This happens locally in your browser.

It does not collect, log or transmit your browsing history, page content or form data. A login you submit is only sent anywhere if you choose Save, and then only in encrypted form to your own vault. Passwords are released to a page only when you choose to fill them, and only on the site they were saved for.

While the vault is unlocked, the extension keeps the encryption key in the browser's in-memory session storage. It is removed when you lock the vault, after the auto-lock period you choose, or when the browser closes. Extension settings and the list of sites where you chose “Never save” are stored locally in the browser.

We do not sell or share your data, use it for advertising, or use it to determine creditworthiness. We use no third-party analytics or trackers in the extension. Google provides the hosting for authentication and storage and processes data only to provide that service.

You can delete any item from your vault at any time. To delete your account and all associated data, contact us from the email address on your account and we will remove it. Uninstalling the extension deletes its local data.

Because we never receive your master password, we cannot reset it or recover your vault if you forget it.