Privacy policy

Data the Extension handles

• Credentials you choose to use — usernames, passwords, TOTP seeds, and any custom fields stored on credentials in your Movitera vault. These are fetched on demand from the Movitera API using your personal access token (PAT) and held in chrome.storage.session (cleared when the browser restarts) and in memory while the popup is open.
• The origin of the page you're on — used locally to decide which credential to suggest. The Extension does not send your browsing history to Movitera. Only the origin you actively autofill or save into is recorded server-side, as part of the credential's audit log.
• Your Movitera PAT — stored locally in chrome.storage.session and used to authenticate API calls. The Extension does not transmit your PAT to anyone other than the Movitera API used by the installed build.

Data the Extension does not handle

• We do not collect analytics, telemetry, or crash reports from the Extension itself.
• We do not read or transmit form data that you have not explicitly chosen to save.
• We do not contact any third-party service. The only network endpoint the Extension talks to is the Movitera API.

Permissions

• storage — stores the unlocked session in chrome.storage.session and minimal local preferences, such as the last team used for saving.
• activeTab / tabs — lets the Extension identify the current tab, compare the origin with Vault credentials, and send the fill command to the page you are using.
• alarms — drives the idle-lock timer that clears the session PAT after the period you configure.
• identity — runs the secure browser authorization flow with chrome.identity.launchWebAuthFlow.
• <all_urls> host access — required to detect login forms on any site where you choose to use Vault.

Contact

Privacy questions: privacy@movitera.com