Legal — Browser Extension

Vaultherit Bridge — Privacy Disclosure

Last updated: October 2026

This page covers the Vaultherit Bridge browser extension specifically — a separate, optional add-on that lets the Vaultherit desktop app fill and save logins from Chrome or Edge. It supplements, and does not replace, the main Vaultherit Privacy Policy, which covers the website and desktop/mobile apps.

The short version. The extension sends nothing to any Vaultherit server, and nothing to any third party. Every message it sends goes to a small helper program (the "native host") running on your own computer, which relays it to your own already-running, already-unlocked Vaultherit desktop app — over your own machine's local process communication, never over the network.

1. What the extension can see

The current tab's URL — read only to identify which site you're on, so a "Fill" request can be matched against the right saved login.

The visible login form on the current page — a username/email field and a password field, read only when you click "Save this login to Vaultherit," or filled only when you click "Fill from Vaultherit" and then pick a specific saved login. Nothing is read or filled automatically; both actions require an explicit click every time.

The extension does not read page content beyond form field detection, does not track browsing history, does not run on browser-internal pages, and does not operate until you click the toolbar icon yourself.

2. Where that information goes

Nowhere outside your own computer. A "Fill" or "Save" click sends one message to the native host process, which is installed and running only on your machine; the native host relays it to the Vaultherit desktop app (also on your machine) and relays the reply back. No Vaultherit server, and no server operated by anyone else, is ever contacted by the extension itself.

If you separately use Vaultherit's own optional cloud backup or multi-device sync features, those are part of the desktop app, governed by the main Privacy Policy — not something the extension causes or is involved in.

3. Why each permission is requested

• activeTab — to read the current tab's URL and to message the content script, only in direct response to a click on the extension's own popup.

• nativeMessaging — to talk to the local native host described above; this is how the extension reaches your desktop app at all.

• Content script on http/https pages — to detect a login form on whatever page you're currently viewing when you choose to use Fill or Save. The content script takes no action and transmits nothing on its own; it only responds when the popup messages it after your click.

4. What the extension does not do

It does not collect analytics, does not include advertising or tracking code of any kind, does not sell or share data with anyone (there is no data collected to sell or share), and does not run any code when a form isn't visible or when you haven't clicked its icon.

5. Current status

The extension's source code ships with a README covering its full technical design, known limitations, and a residual-risk disclosure — including that the bridge folder on your device briefly holds plaintext credentials during a Fill request, a real local-device consideration distinct from anything covered above. Ask support@vaultherit.com if you'd like a copy.

6. Contact

Questions about this disclosure: support@vaultherit.com.