Privacy policy

Data the Extension handles

• Credentials you choose to use — usernames, passwords, TOTP seeds, and any custom fields stored on credentials in your Movitera vault. These are fetched on demand from the Movitera API using your personal access token (PAT) and held in chrome.storage.session (cleared when the browser restarts) and in memory while the popup is open.
• The origin of the page you're on — used locally to decide which credential to suggest. The Extension does not send your browsing history to Movitera. Only the origin you actively autofill or save into is recorded server-side, as part of the credential's audit log.
• Your Movitera PAT — stored locally in chrome.storage.session and used to authenticate API calls. The Extension does not transmit your PAT to anyone other than the Movitera API endpoint you configure.

Data the Extension does not handle

• We do not collect analytics, telemetry, or crash reports from the Extension itself.
• We do not read or transmit form data that you have not explicitly chosen to save.
• We do not contact any third-party service. The only network endpoint the Extension talks to is the Movitera API URL you configure in the popup.

Permissions

• storage / <all_urls> host access — required because you save credentials on arbitrary websites; the Extension needs to detect login forms wherever they appear.
• alarms — drives the idle-lock timer that clears the session PAT after the period you configure.

Contact

Privacy questions: privacy@movitera.com