Secretus Browser Extension — Privacy Policy

The Secretus extension provides one-time, end-to-end encrypted secret sharing. It follows a zero-knowledge design: encryption happens on your device, and decryption keys never reach our servers.

WHAT WE RECEIVE
• Ciphertext of the secrets you create. We cannot read it — the decryption key travels only in the URL fragment of the link you share, which browsers never send to servers.
• An optional label you may add to a secret. This is stored in plain text and is readable by us.
• Your account email, for authentication. Password sign-in uses SRP, so your password itself never leaves your device.

WHY FIREFOX SHOWS "PERSONAL COMMUNICATIONS" AND "AUTHENTICATION INFO"
Your encrypted secrets pass through our servers on the way to the person you share them with, so we declare that category even though the content is unreadable to us. "Authentication info" covers signing in to your Secretus account.

DATA STORED IN YOUR BROWSER
• An authentication refresh token in session storage, cleared when you close the browser and never synced between devices.
• Your preferred expiry setting.
• For the "My secrets" list: local metadata about secrets you created from that browser — identifier, optional label, and dates only. The extension never stores secret content, share links, or decryption keys.

PAGE ACCESS
The extension reads the current page only when you explicitly invoke "Share selection securely" from the right-click menu, and only the text you selected. It does not read, collect, or transmit browsing history or page content otherwise.

NETWORK COMMUNICATION
The extension communicates only with AWS Cognito (authentication) and the Secretus API (api.eu.secretus.app). Data is stored in the EU (eu-central-1, Frankfurt).

NO TRACKING
The extension contains no analytics or tracking of any kind.

RETENTION AND DELETION
Secrets are deleted after a single view or at expiry, whichever comes first. You can delete your account and its data at any time from your Secretus profile.

Full policy: https://secretus.app/privacy (section 13 covers the extension)
Contact: legal@secretus.app