VAULT / PRIVACY / 12 OCTOBER 2026
Private, by where
your data lives.
The extension operates locally. Here is what it stores, what its permissions do, and where the boundaries are.
01 / YOUR DATA
Stored on your device.
Aftercurve Vault has no account service, application server, cloud sync, analytics, telemetry, advertising, or crash-reporting endpoint. Its bundled runtime makes no network requests. The content security policy sets network connections to none.
The browser profile stores an encrypted vault containing your entries, settings, and any active receive key. Unencrypted envelope metadata includes the format, algorithm parameters, salt, nonces, vault ID, revision, and ciphertext size. Plaintext entry titles and URLs are not stored separately.
While unlocked, decrypted data is held in the extension worker. Details you choose to open or generate are also displayed in the extension UI. The browser, operating system, clipboard manager, or other privileged software may access data in memory or the clipboard.
Invoking the toolbar button on an HTTPS page records that page's origin, tab ID, and a short-lived fill intent in trusted extension-session storage. It is consumed after a fill attempt, expires after ten minutes, and is removed when the associated vault tab closes.
Opening a documentation link visits aftercurve.app separately and is subject to ordinary website hosting and network processing. This extension policy does not claim that a visit to the website is offline or that its hosting provider keeps no access logs.
02 / PERMISSIONS
Each permission has a job.
| PERMISSION | PURPOSE |
|---|---|
| storage | Save encrypted vault contents and short-lived fill intents. Storage access is restricted to trusted extension contexts. |
| activeTab | Temporarily authorize the HTTPS page on which you explicitly invoke the toolbar button. |
| scripting | Inject a one-time fill function into that authorized tab's top frame after you choose a matching login. |
| clipboardWrite | Copy a password or fingerprint when you explicitly request it. The extension does not request clipboard-read permission. |
No permanent access to all websites, browsing-history permission, installed content script, remote executable code, or external messaging endpoint is declared.
03 / YOUR CONTROL
Export. Update. Remove.
Backups and transfer packages are exported only when you request them. They are files outside the extension's storage; you choose where to keep or send them. An encrypted backup requires the password used at export time.
Deleting an entry removes it from subsequent live vault saves. Existing backups, browser/OS copies and clipboard history may still contain it. Uninstalling the extension removes its browser-managed local storage; keep an encrypted backup first. Secure erasure of storage media is not guaranteed.
Updates for this unpacked release are manual. Replace the files in the existing extension folder and reload the same installed extension, following the installation guide. No automatic update service is included.
There is no password-reset service, operator recovery key, or remote deletion endpoint. Changing the master password creates a fresh encryption key for the live vault but does not update or revoke old exported files.
Installation & updates ↗