Browser Extension Privacy & Permissions Policy
Last updated: October 27, 2026
1. Single Purpose Statement
The Mellott Cloud browser extension (for Google Chrome, Chromium, Brave, Microsoft Edge, and Mozilla Firefox) has a single, narrow purpose: providing zero-knowledge password vault autofill, TOTP two-factor code generation, passkey (WebAuthn) mediation, and authenticated quick actions for your personal Mellott.US cloud account.
2. Chrome Web Store User Data Policy & Limited Use Compliance
The use of information received from Google APIs and browser extension APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
- The extension only reads page URLs or DOM input elements when needed to match and autofill credentials from your own encrypted vault or capture a credential you explicitly choose to save.
- No browsing history, form inputs, or personal data are ever sold, transferred to third parties, used for personalized or behavioral advertising, or used to determine creditworthiness or lending eligibility.
- No human at Mellott.US or any third party can read your vault items because all vault encryption and decryption occur locally on your device using your master key.
3. Zero-Knowledge Client-Side Cryptography
All vault secrets are encrypted and decrypted exclusively inside the extension's isolated WebCrypto context using Argon2id key derivation and AES-256-GCM authenticated encryption, transported over an additional X25519 + AES-256-GCM end-to-end encrypted session envelope. Optional compromised-password checks use the Have I Been Pwned (HIBP) k-anonymity range API by transmitting only the first 5 characters of a SHA-1 hash; full passwords and full hashes never leave your device.
4. Mozilla Firefox AMO & Microsoft Edge Data Collection Disclosures
In accordance with Mozilla Firefox Add-on Policies, the extension declares data_collection_permissions.required: ["none"]. The extension does not embed third-party analytics SDKs, telemetry trackers, or remote code execution. All executable JavaScript and WebAssembly modules are bundled inside the signed extension package reviewed by the store.
5. Uninstallation, Data Deletion & Contact
Removing the extension from your browser immediately purges all locally cached ciphertext in browser.storage.local and browser.storage.session. To permanently delete your cloud vault and Mellott.US account, visit our Account & Personal Data Deletion Page. For support or security questions, email support@mellott.us or review our Privacy Policy and Terms of Service.
6. Manifest V3 Permissions Justification Table
| Permission / Host | Technical Justification & Scope |
|---|---|
| storage | Stores encrypted vault ciphertext blobs, lock timeout preferences, and session state locally inside browser.storage. Plaintext passwords are never written to disk. |
| alarms | Triggers the automatic vault auto-lock timer and periodic encrypted delta sync with your Mellott.US server inside the Manifest V3 service worker. |
| identity | Completes OAuth 2.0 + PKCE authentication against auth.mellott.us when signing in to your personal cloud account. |
| notifications | Displays local browser notifications for vault lock events, passkey confirmation prompts, and security alerts. |
| contextMenus | Adds right-click context menu actions to autofill credentials, copy TOTP verification codes, or generate a new password on the active form field. |
| activeTab | Inspects the currently focused tab URL and login fields only when you explicitly invoke autofill via keyboard shortcut (Ctrl/Cmd+Shift+L), toolbar popup, or context menu. |
| clipboardWrite | Copies usernames, generated passwords, or TOTP codes to your system clipboard when you click Copy, and clears the clipboard after the configured timeout. |
| scripting | Injects the credential autofill and WebAuthn/passkey bridge script into the active page on demand to populate login inputs. |
| https://mellott.us/* & https://auth.mellott.us/* | Host permissions restricted to the official Mellott.US API and OIDC authentication server for end-to-end encrypted vault synchronization. |