ThorStorage Password Manager — Privacy Policy

Last updated: 2026-08-03

The ThorStorage Password Manager browser extension is a zero-knowledge password vault. It is designed so that your passwords are encrypted inside your own browser and can only ever be read by you — not by us, not by the server that stores them, and not by any third party.

What data the extension handles

• Your saved logins (website, username, password, optional notes and one-time-code secret). These are encrypted in your browser with a master password only you know, using AES-256-GCM. The server you connect to (your own ThorStorage) receives and stores only the resulting ciphertext blob — never a readable password and never your master password.
• Your master password never leaves your browser and is never sent anywhere. It is held only in volatile memory while the vault is unlocked and is wiped on lock or browser close.
• A per-device access token (used to sync the encrypted blob to your ThorStorage) is stored locally; the server keeps only a one-way hash of it and it can be revoked at any time.

What we do NOT do

• We do not collect, transmit, sell, or share your data with anyone.
• There is no analytics, no tracking, and no third-party services. The extension talks only to the ThorStorage server address you configure.
• The server operator cannot decrypt your vault — it holds ciphertext only.

Where your data lives

Your encrypted vault is stored on your own ThorStorage server (the address you enter). Locally, the extension stores only the server address, the revocable device token, and an encrypted copy of the vault for offline use. The decrypted vault and vault key exist only in memory while unlocked.

Permissions and why they are needed

• storage — save the server address, the device token, and the encrypted vault cache.
• alarms — automatically lock the vault after a period of inactivity.
• clipboardWrite — copy a username or password to the clipboard on your request (cleared shortly after).
• tabs — know the current tab's site so autofill only offers logins that match it.
• privacy — optionally turn off the browser's built-in password saving so this manager can act as your default (only when you enable that toggle).
• Host access to https://*/* (granted by you) and a content script on https:// pages — to offer to fill saved logins and to offer to save a new one when you sign in. Filling is always user-initiated; nothing is read or sent without your action.

Data deletion

You control all of it: revoke a device, delete individual logins, or reset the whole vault from your ThorStorage Passwords page. Removing the extension wipes all local data.

Contact

Questions about this policy: support@remote-data.ro.