Privacy Policy

Summary

Show Password Fields does not collect, sell, or share data about you, your browsing activity, or the contents of any password field. It transmits nothing in the background; the only information that ever leaves your device is what you choose to submit through its feedback form (see Data collection below).

Data access

To do its job, the extension must read the value of a password input element when you explicitly ask it to by clicking the toolbar icon, using the context menu, or holding Alt while hovering. This reading happens entirely on your device, in the browser tab where you performed the action. The value is never sent anywhere.

The extension declares the <all_urls> content-script match so that it can function on any website where you might encounter a password field. Beyond that it requests only two narrow permissions: contextMenus (for the right-click menu items) and storage (to save your preferences locally — see Data collection below). It does not request host_permissions, networking, or background access.

Data collection

• It does not collect or transmit analytics, telemetry, or usage data. It runs no tracking code and makes no network requests in the background.
• It does not store passwords or browsing history. Using chrome.storage.local it saves, on this device only, your extension preferences (auto-hide duration, loupe options, the per-site blocklist, and your password-generator settings such as length and which character types to include) plus a handful of non-personal counters used to decide when to show the rating prompt — for example a first-use date, how many times you have revealed a field, and whether you have already rated or dismissed the prompt. None of this includes a password, and none of it is ever uploaded.
• It does not sync anything across devices.
• It does not include third-party libraries, trackers, or advertising SDKs.
• It does not read or modify the contents of any field that is not a password input you have interacted with.

The extension can open external pages that you choose to use: the Chrome Web Store, a welcome page shown once when you first install it, and a feedback form that opens if you rate the extension 1–3 stars. These open as ordinary browser tabs. The feedback form receives only what you type into it, plus the extension version and your browser's interface language, and only when you press Submit — nothing is sent silently in the background.

Clipboard

When you choose Copy password from the right-click menu, the extension writes the password to your operating system clipboard using the standard navigator.clipboard.writeText Web API. Thirty seconds later, the extension attempts to clear the clipboard, but only if browser clipboard restrictions allow it to confirm that the clipboard still contains the password it wrote. Anything you copy in the meantime is left alone.

Password generation

When you choose Generate password from the right-click menu, or use the generator on the settings page, the password is created entirely on your device using the browser's built-in cryptographic random number generator (crypto.getRandomValues). Generated passwords are not logged, not stored, and never transmitted. If a password field is available the value is typed into it on the page; it is also placed on your clipboard, where the same best-effort 30-second cleanup described under Clipboard applies.

Chrome Web Store Limited Use

The use of information received from Chrome APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Contact

For privacy questions, contact showpassword@staply.app.