Last updated: 2026-07-11

Startup Lock does not collect, transmit, sell, or share any data. Ever.


Startup Lock stores the following only on your own computer, inside your Firefox profile (browser.storage.local), and never sends it anywhere:

• Salted hashes of your two passwords. Passwords are never stored in plaintext and are never transmitted. They are hashed on your device with PBKDF2-SHA256 (150,000 iterations, a unique random salt per password).
• The URLs of your open tabs, saved temporarily so they can be restored after you unlock. This list is deleted as soon as you unlock, and is erased by the duress-wipe password.
• Your settings (idle timeout) and a failed-attempt counter.

• It makes no network requests of any kind.
• It contains no analytics, telemetry, tracking, or advertising.
• It loads no remote code and includes no third-party libraries.
• It has no server, no account, and no way to phone home.

Entering the wipe (duress) password runs Firefox's own browsingData API locally to clear browsing data on your device. Nothing is uploaded; the data is simply deleted from your machine.


Because no personal data ever leaves your device and none is transmitted to the author or any third party, there is no data controller or processor collecting your information through this extension. You remain in sole control of the data in your own Firefox profile.


Questions about this policy can be filed as an issue at <https://github.com/maca-sys/FirefoxStartupLock/issues> or sent to <mtahmasebi118@gmail.com>.