Extension data
Routines, scheduled addresses, preferences and activity stay in the extension's local IndexedDB storage in your Chrome profile. Exported backup files are unencrypted JSON; store and share them carefully. We do not ask for your Chrome password or access to destination-page contents.
License service
License requests use HTTPS. The issuer runs in a restricted container on an OVHcloud VPS, behind the existing Caddy reverse proxy. The issuer stores a one-way SHA-256 hash of each redemption key. License receipts and revocation proofs are signed with Ed25519 so the extension can verify them without receiving the private signing key.
The database, signing keys and administration token are held in restricted server storage. Public client builds contain only public verification keys and the service address. The service limits request rates and rejects unsupported browser origins. Administrative routes require a separate bearer token. We do not enable request-body or license-key logging.
Updates and incidents
We review dependencies and deploy fixes when a security issue affects the extension or issuer. If we discover a security incident involving personal information, we will assess its impact and notify affected people and authorities where required. We cannot guarantee that any software or network is free of all risks.
Report a vulnerability
Send a concise report to artur@fromartur.com with the affected component, steps to reproduce and a safe contact method. Do not include other customers' personal data, exploit the issue beyond what is needed to demonstrate it, or publish a working exploit before we have had a reasonable chance to investigate. We will acknowledge actionable reports and coordinate a fix and disclosure with you.