Privacy Policy

Effective Date: August 13, 2026

BrowserProfileLock ("we", "our", or "extension") is committed to protecting your privacy. This Privacy Policy explains how our Chrome extension handles your data and personal information.

1. Data Collection and Storage

Local Storage Only: BrowserProfileLock operates entirely on a local-first architecture. Master passwords, password hashes, salts, device prefixes, and cryptographic keys (such as your ECDSA private and public keys) are stored securely on your local machine using Chrome's local and session storage APIs (`chrome.storage.local`, `chrome.storage.session`).
No Cloud Password Storage: We never transmit, save, or have access to your raw master password on any external servers.

2. Device Registration and Offline Reset Protocol

Device Enrollment: During initial setup, your chosen name, email address, device prefix, and an exported public key are sent to our secure enrollment server (`browserlock-reset.iamtac.com`) to manage account recovery and device registration.
Offline Recovery: The Offline Reset Protocol utilizes asymmetric cryptography (ECDSA P-256) and challenge-response mechanisms entirely locally on your browser to authorize password resets without continuously syncing private data to the cloud.

3. Permissions Usage

To provide session locking and profile security, BrowserProfileLock utilizes specific browser permissions declared in its manifest:

`storage` & `session`: Used locally to save your encrypted password hashes, preferences, and temporary tab states during locks.
`tabs`, `webNavigation`, & `scripting`: Used to intercept unauthorized navigation when locked, redirect views to the secure lock screen (`lock.html`), restore user tabs upon successful authentication, and toggle optional browser dark/light mode styles.
`idle`: Used to monitor system activity levels to trigger automatic session locks based on your configured inactivity timeouts.

4. Data Sharing and Disclosure

We do not sell, trade, or transfer your personal information or browsing data to third parties. Data processed during device enrollment (such as your name and email) is used strictly for authentication recovery and server-side verification checks through our designated domain (`browserlock-reset.iamtac.com`).

5. Security Measures

We implement robust cryptographic safeguards, including PBKDF2-HMAC-SHA256 hashing with random salts for local passwords and ECDSA P-256 digital signatures for challenge-response flows, ensuring your profile remains secure against unauthorized access.

6. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the effective date at the top of this policy.

7. Contact Us

If you have any questions or concerns regarding this Privacy Policy or your data, you may reach out through our official support and reset portal channels at `browserlock-reset.iamtac.com`.