BrowserVault BrowserVault
Install extension

Privacy Policy · BrowserVault

Local-first security.
Absolute privacy.

BrowserVault keeps your browser safe using on-device encryption. Your master password, biometrics, and browsing activity never leave your computer.

Local AES Encryption No Tracking Your Keys, Your Vault

Last updated: July 13, 2026

Overview

BrowserVault ("the extension", "we", "our") is a security-focused Chrome extension designed to lock your browser interface, protect against unauthorized access, and automate privacy safeguards (like wiping history). This policy explains how the extension handles your data.

The short version: BrowserVault is built on a local-first architecture. Your master password is cryptographically hashed (using PBKDF2) and stored directly on your own device. The extension has no external analytics, no advertising trackers, and only communicates with a dedicated backend solely for OTP email recovery.

Data we collect

The extension operates almost entirely offline. We do not collect, transmit, store remotely, or sell:

  • Your master password (only a salted hash is kept locally)
  • Your biometric data (handled securely by your device's WebAuthn API)
  • Your browsing history or the URLs you visit
  • Personally identifiable information (name, IP address, device ID)
  • Analytics, usage events, crash reports, or diagnostics

Recovery Email: If you choose to configure a recovery email address, this email is saved locally and only transmitted to our secure OTP-generation backend when you explicitly request a password reset code. We do not store your email in a database or use it for marketing.

Permissions explained

Chrome Manifest V3 requires extensions to declare every permission upfront. Here is exactly what each one is used for — and what it is never used for.

storage

Saves your master password hash, extension preferences (like auto-lock timers), and activity logs in Chrome's local storage on your own device.

idle

Used exclusively by the "Idle Auto-Lock" feature to detect when you step away from your computer so the extension can automatically secure the browser.

tabs

Allows the extension to redirect tabs to the lock screen, prevent closing the lock page, and execute the core locking mechanism across all active windows.

notifications & alarms

Alarms are used to trigger Scheduled Locks at your designated times. Notifications are used to warn you 30 seconds before an automated lock occurs.

history & declarativeNetRequest

History permission is only used to instantly wipe your browsing history upon lock (if you enable that setting). declarativeNetRequest empowers the Domain Watcher feature to instantly block and redirect restricted websites.

Site & API scope

The extension declares the following host permissions:

host_permissions & content_scripts

<all_urls> https://browser-vault-backend.vercel.app/*

Content scripts must run on <all_urls> to successfully deploy the lock overlay over any website you might be visiting when the browser locks. The API permission is strictly used to interact with our backend service to dispatch One-Time Passwords (OTPs) to your email during password recovery.

Where your settings live

All sensitive information, activity logs, and configurations are saved locally via Chrome's chrome.storage.local API. If you uninstall the extension, this data is completely erased from your device. We do not maintain a cloud database of your passwords or settings.

Third parties

We do not share, sell, rent, or trade any information with any third party. The extension embeds no advertising networks, analytics libraries, or crash-reporting tools.

Changes to this policy

If this policy changes, this page will be updated and the "Last updated" date at the top will reflect the change. Material changes will also be noted in the extension's Chrome Web Store release changelog.

Contact

Questions about this policy or the extension can be sent through either of the following channels:

Open a GitHub issue rijoan.com

Developed by Md Rijoan Maruf.