Privacy Policy

The Rotor extension collects nothing, sends nothing and stores nothing outside your own browser profile. This is not a policy choice that could be reversed in an update without anyone noticing: the extension's content security policy sets connect-src 'none', which means the browser itself refuses to let it open a network connection, and a build step fails the release if a URL, eval or a dynamic import appears in the bundle.

Two keys in chrome.storage.local, on your machine: your encrypted vault (ciphertext plus the public parameters needed to derive the key again) and your settings. Nothing account-identifying is written to either.

The key that decrypts the vault exists only in chrome.storage.session, which lives in memory and is discarded when the browser closes. It is never written to disk, never synced, never put in a message, and never logged.

There is no telemetry, no analytics, no crash reporting, no usage counter and no remote configuration — not opt-in, not behind a flag, not behind a consent dialog. See the published guarantees and the manifest.

The extension requests exactly two: storage, to keep the encrypted vault on your machine, and alarms, to tick the 30-second code window and the auto-lock timer. There are no host permissions, so it cannot read any web page, see your browsing history, or observe anything outside its own window.

A future version will offer optional sync through your own Google Drive application folder. When it ships: the data is encrypted before it leaves your machine, the folder belongs to your Google account rather than to us, we never receive a copy or a key, and the feature is off until you turn it on. Until it ships, no Google API is contacted at all.

This site is a set of static pages. It sets no cookies, runs no analytics, embeds no third-party scripts, and loads no remote fonts. Our hosting provider processes standard server request logs (IP address, timestamp, requested path) for security and operational purposes on our behalf.

If and when paid tiers open, checkout will be handled by a merchant of record who acts as the seller and processes your payment and billing details under their own privacy policy. We will name them here before taking a single payment.

Because we hold no personal data about you, there is generally nothing to access, correct, export or erase. If you email us, we hold that correspondence until it is resolved and for a reasonable period afterwards. Write to support@dfacto.ai with any request and we will answer within 2 business days.