Privacy Policy
1. Who we are
Stash — Encrypted Private Bookmarks is a Chrome extension developed by Triple Up ("we", "us", "our"). Stash is a Chrome side-panel extension that keeps a password-locked, encrypted list of private bookmarks (with automatic page-screenshot thumbnails, optional named collections, and a per-bookmark importance rating) that auto-locks when the panel or browser closes. You can reach us at tripleup.dev@gmail.com.
2. Information we collect
Stash — Encrypted Private Bookmarks processes the following information solely to provide its features:
- Bookmark URLs you choose to save (stored AES-256-GCM encrypted, on-device only)
- Bookmark page titles you choose to save (stored encrypted, on-device only)
- Screenshot thumbnails of pages you explicitly bookmark (stored encrypted, on-device only)
- Per-bookmark metadata: creation timestamp, favorite flag, visit count, an importance rating you set, the collection you file it under, and an internal session index (stored encrypted, on-device only)
- Collection names you create (stored encrypted, on-device only)
- Settings: the incognito-only toggle (stored unencrypted in local storage, on-device only)
3. How your data is stored
All bookmark data (URLs, titles, screenshot thumbnails, collection names, and per-bookmark metadata) is encrypted with AES-256-GCM using a key derived from your password via PBKDF2 (SHA-256, 250,000 iterations), and stored only on your device in chrome.storage.local under the "vault" key. Because thumbnails make that vault larger than Chrome's default 10 MB local-storage quota, the extension requests the unlimitedStorage permission, which raises that on-device ceiling only — it does not move or upload anything. Your password is never stored. The derived encryption key is held only in chrome.storage.session for the duration of an unlocked session and is cleared automatically when the side panel or browser window closes (auto-lock); each side panel must be unlocked on its own, including a second window's. A single non-sensitive setting (the incognito-only toggle) is stored unencrypted in chrome.storage.local. Encrypted backups are exported/imported only as local files you control. No data is ever transmitted to any server.
No data is sent to Triple Up or to any external server.
4. Third parties & advertising
Stash — Encrypted Private Bookmarks does not use third-party analytics, tracking, or advertising, and does not sell or share your data with third parties.
5. Browser permissions
Stash — Encrypted Private Bookmarks requests only the permissions it needs:
storage— Persist the encrypted bookmark vault and the cached session key on the user's device, plus the single settings toggle.unlimitedStorage— Raise Chrome's default 10 MB local-storage quota so a vault holding many screenshot thumbnails can still be saved on the device. It grants no access to anything else and moves no data off the device.tabs— Read the current tab's URL and title when the user saves a bookmark, detect when a bookmarked page has finished loading so the correct tab's thumbnail can be captured, and open a saved bookmark in a new tab.sidePanel— Render the extension UI in the Chrome side panel, open it when the toolbar icon is clicked, and receive the panel-closed event that locks the vault.host_permissions: <all_urls>— Allow chrome.tabs.captureVisibleTab to take a screenshot thumbnail of any page the user explicitly bookmarks, regardless of its domain. The extension injects no content scripts, never reads page contents, and makes no network requests.
6. Children's privacy
Stash — Encrypted Private Bookmarks is not directed to children under 13, and we do not knowingly collect personal information from children.
7. Changes to this policy
We may update this policy from time to time. Any material change will be posted on this page with a revised "last updated" date.
8. Contact
If you have any questions about this policy, email us at tripleup.dev@gmail.com.
← Back to Triple Up