1. Controller and scope
Samin Sabahudin Grahich (Apiboo), Traunaustraße 29/13, 4600 Wels, Österreich, is the data controller. This policy covers the Apiboo Vault browser extension only. Your Apiboo account, the desktop app and this website are covered by the general privacy policy at apiboo.com/privacy, which also lists your rights and our processors. Contact: hello@apiboo.com.
2. What the extension does
It is a password manager for your own Apiboo vault: it offers the logins that belong to the website you are on, fills them into the login form when you choose one, saves a new login if you ask it to, signs in with passkeys stored in your vault and creates new ones there when a website offers it. It works on its own, with a single source: the end-to-end encrypted copy of your vault in your Apiboo account, which it downloads and decrypts in your browser with your master passphrase. The Apiboo desktop app is not needed; if you use it, it is just another device that syncs the same vault.
3. What stays on your device
Your master passphrase, the key derived from it and every decrypted password, code and passkey exist only in the memory of the extension while the vault is unlocked. The extension reads the login form of the page you are on to find the fields to fill and to recognise a login you just typed; nothing read from a page is sent anywhere. Your master passphrase and your decrypted data never leave the browser; only ciphertext travels to Apiboo.
4. What is sent to Apiboo, and why
The extension talks to exactly two hosts, auth.apiboo.com and api.apiboo.com; it refuses to send a token anywhere else.
Sign-in. You sign in on auth.apiboo.com (OAuth 2.0 with PKCE). The extension receives tokens limited to the vault, and from them the e-mail address of your account, which it shows in its popup (contract performance). Your encrypted vault. The extension downloads and uploads your vault items as ciphertext plus the bookkeeping the server needs to keep devices in step (item id, version, time). Apiboo cannot read them: there is no key on our side (contract performance). Device entry. This browser is listed under Devices in your Apiboo account with the type and name you gave it and when it was last seen, so that you can remove it from there (contract performance). Website icons. If "Show website icons" is on (the default), the popup loads an icon for each entry it shows from our icon server, naming only the registrable domain of that entry (for example example.com), without any token, referrer or account link; a missing icon is reported once per domain. Turn the option off and no such request is made (legitimate interest, Art. 6(1)(f) GDPR, in a readable list).
Requests to our API are rate-limited by IP address, held in memory for the limit window and not written to disk; the general policy describes our operational logs.
5. What we do not do
No analytics, no advertising, no tracking, no browsing history. The extension does not record which sites you visit, does not read pages beyond their login forms, does not sell or share personal data, and does not use it for anything but the single purpose above.
6. What is stored in your browser
A sign-in token that grants ciphertext only, the encrypted vault cache and its bookkeeping, and your settings (idle time, clipboard clearing, website icons, passkeys on or off). The vault key is held in session storage, which the browser erases when it closes. Lock, sign out or remove the extension and the respective data is deleted from this browser.
7. Locking, clipboard, passkeys
The vault locks after the idle time you choose (default 15 minutes) and whenever the browser restarts. A copied password or code is cleared from the clipboard after the chosen time (default 30 seconds). Passkeys are on by default; the switch is a setting of your vault (in the Apiboo desktop app under Settings → Extensions → Vault) and syncs to the extension. Every passkey sign-in or creation asks for your approval first; an unlocked vault alone is never enough. Passkey private keys are only ever used to sign inside the extension and are never shown or exported in clear text.
8. Retention and deletion
Signing out removes the vault from this browser at once. "Delete my cloud copy" in the Apiboo app removes the encrypted vault from our servers; backups of it are kept for 30 days and then gone. Deleting your Apiboo account deletes everything within 30 days, as described in the general policy.
9. Your rights, processors and transfers
These are the same as for your Apiboo account and are set out, together with the supervisory authority you can turn to, at apiboo.com/privacy.
10. Changes
We announce material changes by e-mail or in the app before they take effect. The latest version is always at apiboo.com/privacy/extension.