# Privacy policy — Paste Vault

**Last updated: 9 November 2026**

This is the public privacy policy for the Paste Vault Chrome extension. Host it
at a stable URL and put that URL in the Chrome Web Store listing.

## Summary

Paste Vault does not collect, transmit, sell or share any personal data.
Everything it stores stays in your browser profile on your own device - unless
you turn on snippet sync, in which case Chrome Sync keeps your snippets in your
own Google account. The developer never receives them.

## What Paste Vault stores

Paste Vault stores, in your browser's local storage on your device:

- text and image clips that **you** save, either by choosing "Copy & save to
  Paste Vault" from the right-click menu, by pressing the extension's keyboard
  shortcut, or — if you turn capture mode on and allow a specific site — by
  copying on that site;
- for each clip: when it was saved, its size, how it was saved, the tags you
  gave it, the short name (alias) you gave it if you made it a snippet, and
  optionally the website domain and page title it came from;
- your settings for the extension;
- when an update changes how the extension stores data, one backup copy of
  your clips taken just before the change, so nothing is lost if the change
  goes wrong. It stays on your device, is shown in the extension's settings
  where you can download or discard it, and is deleted automatically after 30
  days.

## What Paste Vault does not do

- It does not send any of this data anywhere. The extension makes no network
  requests at all.
- It does not use a server, an account, analytics or telemetry.
- It syncs nothing unless you turn snippet sync on. Then Chrome Sync stores your
  snippets (clips you gave a short name) and a few preferences in the Google
  account Chrome is signed in to, so they appear on your other computers. If you
  set a passphrase they are end-to-end encrypted: Google stores only data it
  cannot read. Your clip history, images, clips flagged as possibly sensitive,
  and the sites you allowed never sync. Turning sync off stops it; "Delete the
  synced copy" in the settings removes it from your Google account.
- It does not read your clipboard in the background. It cannot see what you copy
  in other applications, in other browsers, or on sites you have not allowed.
- It does not read password fields. Content from a password or one-time-code
  field is refused before it is stored.
- It does not load or execute code from anywhere except its own package.

## Who can see your data

Only you, on the device where the extension is installed. Paste Vault has no
operator with access to your clips, because there is nothing to have access to —
no server receives them.

## Permissions

Paste Vault requests no access to any website when you install it. If you turn
on capture mode, Chrome asks you to allow one specific site at a time; you can
withdraw that at any moment from the extension's settings or from
`chrome://extensions`.

It shows website icons in the command palette using Chrome's own icon cache on
your device. Showing them makes no network request.

## Your choices

- **See everything** stored, in the extension's manager.
- **Delete** any clip, any selection, or everything, at any time. Deleting moves
  clips to a trash on your own device, where they stay for up to 30 days so a
  mistake can be undone, and are then removed permanently. To remove something
  immediately, open the trash and use **Delete forever** or **Empty trash**.
  "Erase everything" removes every clip, the trash, and the pre-update backup.
  It keeps your settings and the list of sites you allowed; remove a site from
  the settings, or uninstall the extension to remove everything.
- **Export** your clips to a local, verified `.zip` backup you control (each payload carries a SHA-256, checked on restore).
- **Set retention** so clips are removed automatically after 7, 30 or 90 days.
- **Refuse to store** clips the extension flags as possibly sensitive.
- **Uninstall.** Removing the extension removes all of its stored data from that
  computer. If you used snippet sync, use "Delete the synced copy" in the
  settings first to remove your snippets from your Google account as well.

## The command palette and the pages you visit

The command palette opens over the web page you are on, but it runs separately
from that page, in the extension's own isolated frame. The page cannot read the
palette, see your clips in it, or observe what you type into it. Websites also
cannot detect whether Paste Vault is installed by looking for its files.

When you choose a clip and press Enter, Paste Vault types that clip into the
field you were typing in on that page - which gives that page the clip, just
as pasting it would. It never types into a password field. Answers you type
into a snippet's fill-in fields go into the page with the snippet and are not
stored.

## Children

Paste Vault is not directed at children and collects no data from anyone.

## Changes

If a future version of Paste Vault ever changes what it stores or where it
stores it, this policy will be updated before that version is published, and the
change will be described in the extension's changelog.

## Contact

Questions about this policy: write to the developer email address shown on the
Chrome Web Store listing.