Privacy policy
Applies to the SpiderPass browser extension and the SpiderPass server software. Last updated 2026-10-28.
The short version
SpiderPass is software you run yourself. We, the authors, operate no servers that your data goes to, and we collect nothing: no analytics, no telemetry, no advertising, no accounts with us.
What the extension handles
- Your server's address and your email, stored in your browser so you don't retype them.
- Your unlocked keys and session, kept only in the browser's in-memory session storage. They are erased when you lock, when the auto-lock time passes, or when you close the browser. They are never written to disk.
- Your vault, which is downloaded from your own SpiderPass server in encrypted form and decrypted on your device. Your master password and decrypted passwords never leave your device and are never sent to us or to your server.
What the extension does with websites
- It reads or changes a web page only when you ask: by clicking the toolbar icon and choosing Fill, using the keyboard shortcut, or using the context menu. It does not run on pages in the background and does not watch what you browse.
- It fills a login only into pages whose address matches the saved login, and only on encrypted (https) pages or pages on your own machine.
Network requests
The extension talks only to the SpiderPass server address you enter. If your server administrator turns on the optional breached-password check, your browser sends the first five characters of a one-way hash of a password (never the password) through your server to a public range service, which cannot tell which password you meant.
Sharing, selling, and permissions
We do not sell, share, or transfer user data to anyone, because we never receive it. Each permission the extension asks for is used only for the feature it names: storage (settings and the in-memory session), alarms (auto-lock and clipboard clearing), scripting and activeTab (filling the page you chose), contextMenus (the right-click fill command), offscreen (clearing the clipboard after 30 seconds), and optional access to your own server's address.
Your server
The person who runs your SpiderPass server can see account emails, when you sign in, and encrypted data. They cannot read your passwords or notes. How long they keep logs is up to them. If they set up outgoing email, the server sends invitations, password-reset links, and short notices about your own account (a sign-in from a new device, a master password change, your account being disabled or enabled) to your email address, and nothing else. Emails never contain vault contents. The server stores your wrapped recovery data, never your recovery key.
Contact
Questions or security reports: please use the project's private security advisory form on its GitHub page.