Privacy Policy
PwdPal is built so that there is nothing to share, because nothing leaves your device. This page documents that promise in detail.
The short version
- Your seed, your pattern, and your passwords never leave your device.
- PwdPal has no backend, no accounts, and no per-user records.
- PwdPal runs no analytics script in your browser — no Google Analytics, no third-party tracker, no cookie that follows you.
- The PwdPal browser extension sends no analytics of any kind.
- The Chrome extension's permissions are used only to make the popup work on the active tab — they are not used to track you, collect history, or read page content beyond the focused password field you choose to fill.
What is stored, and where
On your device (localStorage)
- Your seed phrase
- Your saved domains and their per-site preferences
- Your theme choice
- A small counter of how many passwords you've generated (used locally to decide when to show the "buy me a coffee" tip)
This data lives only in this browser, on this device. Clearing site data or uninstalling removes it permanently. There is no copy elsewhere.
Never stored, anywhere
- Your unlock pattern — you redraw it each session
- Generated passwords — written to the clipboard, then forgotten
- Anything on a server — PwdPal has no backend
Analytics
PwdPal runs no analytics script in your browser — no Google Analytics, no third-party tracker, no cookie that follows you.
The PwdPal browser extension sends no analytics of any kind.
The Chrome extension
The PwdPal Chrome extension is the same UI as the web app, with a small amount of extra code so it can work inside a popup. Specifically:
- It does not load Google Analytics or any other tracker.
- It does not read page content, form values, browsing history, or cookies.
- Its
localStorageis separate from the web app's — they cannot see each other's data except via the explicit one-time migration described below.
Extension permissions, and what they're for
activeTab | Granted only at the moment you click the toolbar icon. Used to read the hostname of the tab you're on, so the popup can pre-pick the right saved card or pre-fill the domain field. |
|---|---|
storage | Used to hold the one-time snapshot exported from pwdpal.com (see migration below). Used nowhere else. |
scripting | Used solely to inject a single, one-shot function that writes the generated password into a <input type="password"> that you have already focused on the active tab. Restricted to password fields by type. Nothing else is read or modified on the page. |
host_permissions for pwdpal.com | Allows the bundled content script to run on pwdpal.com so the one-time migration can happen. The extension does not have permission to read or modify any other website. |
One-time migration from pwdpal.com
If you have used pwdpal.com before installing the extension, the first time you visit pwdpal.com after install, a content script copies your local web-app data (seed, saved domains, preferences) into chrome.storage.local. The next time you open the extension popup, it imports that snapshot into its own localStorage. This happens once and is one-way: web → extension. Subsequent changes on either side do not propagate.
No data is transmitted in this process. It is a copy from one local browser storage to another local browser storage, both on your device.
Third-party requests
The app issues exactly one kind of outbound request during normal use:
- Favicon lookups — to render the small site icon on a saved card, the app fetches the favicon from one of: DuckDuckGo's icon service, icon.horse, or Google's
s2/faviconsendpoint, in that order. Only the domain is sent. No seed, pattern, or password is involved.
Generating a password makes no network request at all. The cryptography runs entirely in the Web Crypto API on your device.
Children
PwdPal is not directed at children under 13, and we do not knowingly collect personal information from anyone — adult or child — beyond the analytics described above.
Changes to this policy
If material changes are made to how PwdPal handles data, this page will be updated and the change will be reflected in the deployed app version. There is no mailing list or account to notify, since there are no accounts.
Contact
For privacy questions, email privacy@pwdpal.com. To report a security issue, email security@pwdpal.com.