GitHubGet Hedhog updates in your inbox
New releases, fresh recipes, and breaking changes — no spam.
HedHog Vaults Privacy Policy
This policy describes how the HedHog Vaults clients handle data. It covers two products, which share the same publisher, the same cryptography and the same relationship with your server:
- the browser extension for Chrome and Edge (extension ID
ojimnolpmeegaaindaaceiodhmlbaljn) — see the extension guide; - the mobile app for Android and iOS (package
com.hcode.hedhogvaults) — see the app guide.
Where the two differ, the difference is stated explicitly. Everything else applies to both.
Effective date: August 3, 2026
Publisher: HCODE CONSULTORIA E TECNOLOGIA LTDA (CNPJ 24.700.731/0001-08), R. Ademar Saraiva Leão, 234 — Parque Alvarenças, São Bernardo do Campo/SP, 09853-120, Brazil
Privacy contact: [email protected] · Data protection officer: [email protected]
1. Two different parties
Neither client has a backend of its own. Each connects to a HedHog server whose address you type in yourself, and talks to no other host.
- The client (extension or app) — covered by this policy, published by HCODE CONSULTORIA E TECNOLOGIA LTDA (CNPJ 24.700.731/0001-08).
- The HedHog server you connect to — operated by whoever runs that installation (your company, your provider, or you). That operator decides what is stored server-side, for how long, and under which agreement. This policy does not govern that server.
2. What the clients collect
Neither client collects anything for the publisher. Neither sends data to HCODE CONSULTORIA E TECNOLOGIA LTDA (CNPJ 24.700.731/0001-08) or to any third party. There is no telemetry, no analytics, no advertising SDK, no crash-reporting service and no third-party network call. Every request either client makes goes to the server address you configured.
Your browsing history is not collected, transmitted or stored. In the extension, matching a page against your vault happens locally on your device, after decryption.
The password health check runs entirely on your device: passwords are decrypted locally, compared locally against the leaked-password corpus, and only the aggregate verdict is reported to your server. Which of your secrets are at risk never leaves your device.
3. What the clients store on your device
Browser extension
| Where | What | Lifetime |
|---|---|---|
chrome.storage.local | API URL, admin URL, access token, refresh token, master key (base64), auto-lock window in minutes, id of the last vault used when saving | Persists on disk in your browser profile until you disconnect, clear the data or uninstall the extension |
chrome.storage.session | A mirror of the unlocked private key and the last-activity timestamp, so a session survives Manifest V3 terminating the service worker | Browser-managed memory, never written to disk. Cleared when the browser closes or the extension reloads. Restricted to privileged extension contexts (TRUSTED_CONTEXTS) and unreachable from a content script |
| Service worker memory only | Decrypted secrets, vault keys, and a captured credential awaiting your confirmation (valid for 5 minutes) | Discarded when the vault locks and when the service worker is terminated |
Mobile app
| Where | What | Lifetime |
|---|---|---|
| Keychain (iOS) / Keystore (Android) | Refresh token, master key, cached private key, offline-cache key | Until you sign out, reset the keystore or uninstall. The master key and the private key are protected by biometrics; the refresh token is not, because a silent token refresh needs it |
| App preferences | Server address, admin address, language, last e-mail used, view mode, aggregate password-health score | Until you sign out or change servers |
| App files | An encrypted snapshot of your vaults — ciphertext only, under a second layer of encryption whose key lives in the keystore — and the leaked-password corpus, which is public data | Erased on sign-out, on a server change, on a keystore reset, and when you turn the offline copy off in Settings |
| Memory only | Master password, vault keys, decrypted content | Discarded when the vault locks |
The offline snapshot exists so vaults you have already downloaded stay readable without a connection. It holds the same ciphertext the server holds — no decrypted content is ever written to disk.
In both clients, the following are never written to disk: your master password, your decrypted private key, vault keys, and decrypted secrets.
4. Encryption and the zero-knowledge model
Item content is encrypted on your device with AES-256-GCM using the vault key, with the vault id as additional authenticated data (AAD). The server never sees plaintext content and never sees the key.
Your private key is derived with Argon2id from your password and your master key (recovery key), and it never leaves your device.
Attachments are encrypted with a key of their own, and that key lives inside the encrypted item — the server stores an opaque blob and never learns the file name.
5. Authorization
Extension: authorization uses OAuth with PKCE via chrome.identity.launchWebAuthFlow. The consent screen is served by the HedHog admin, not by the extension.
App: sign-in is by e-mail and password against your server, with two-step verification when your account requires it; OAuth providers open the consent screen hosted by the admin and return through the hedhogvaults URL scheme.
In both cases the client receives tokens; neither client stores your HedHog account password.
6. Permissions and their purpose
Browser extension
| Permission | Purpose |
|---|---|
storage | Store the configuration described in section 3 |
identity | Run the OAuth authorization flow |
alarms | Lock the vault after a window of inactivity |
idle | Lock the vault when the operating system locks the screen |
activeTab | Fill the form on the tab you are currently using |
Optional host permissions (http://*/*, https://*/*) | Reach the server you configured. Requested on demand, from a user gesture; the manifest declares host_permissions empty on purpose, because the server URL is not known at build time |
The manifest also declares scripting and contextMenus; neither is exercised by any code in the extension today, and neither collects data.
Mobile app
| Permission | Purpose |
|---|---|
| Biometrics | Unlock the vault without typing the master password |
| Camera | Read the two-step verification QR code, and photograph an icon for a vault or a secret. Frames are decoded on the device and no image is uploaded |
| Photos | Choose an image for the icon of a vault or a secret |
| Files | Choose a file to attach, and choose the export file to import. Import files are read, mapped and encrypted on the device — the file itself is never uploaded |
Android backup is disabled (allowBackup: false), so nothing the app stores is copied off the device by the system. Screenshots and screen recording are blocked, and the app-switcher preview is hidden.
Consistent with the Chrome Web Store, Google Play and App Store developer program policies, data handled by these clients is used solely to provide the password-manager features described in their guides. It is not sold, not transferred to third parties, and not used for advertising, credit scoring or lending.
7. Data sharing
No data is shared with third parties. The only destination for data leaving your device is the HedHog server whose address you configured.
8. Retention
Data stored on your device is retained as described in section 3 and is under your control: disconnecting, revoking a granted permission, clearing the client's data, turning off the offline copy, or uninstalling removes it.
Retention of data held by the HedHog server you connect to is defined by the operator of that server. On servers operated by HCODE, the periods are:
- Vault items: kept for as long as they exist. Deleting an item is immediate and permanent, and takes its version history with it — there is no trash bin.
- Vault activity records (item creation, update and reveal): 90 days, purged automatically.
- Expired invitations and shares: 30 days after expiry.
- Account deletion: effective immediately on production systems.
- Backups: a 30-day cycle. Deleted data is no longer reachable through the product, but may remain in backups until the cycle rolls over — that is the real time to complete erasure.
9. Your choices and your rights
You can, at any time and without contacting anyone:
- lock the vault, or reduce the auto-lock window;
- extension: revoke the host permission granted to it, from the browser's extension settings;
- app: turn off the offline copy in Settings, which erases it, and revoke camera, photo or file permissions in the system settings;
- disconnect the client from the server;
- uninstall, which removes everything described in section 3.
To exercise data-protection rights (such as access, correction, deletion or portability) regarding data held by the publisher, write to [email protected]. Which rights apply, and under which law and jurisdiction, is defined by Brazilian law, with venue in São Bernardo do Campo/SP, Brazil. Rights over the data held in the HedHog server you connect to must be exercised with the operator of that server.
10. Changes to this policy
Changes are published on this page, and the effective date above is updated. The URL of this page is stable, so a link to it stays valid across versions of either client.
11. Contact
HCODE CONSULTORIA E TECNOLOGIA LTDA (CNPJ 24.700.731/0001-08) — R. Ademar Saraiva Leão, 234 — Parque Alvarenças, São Bernardo do Campo/SP, 09853-120, Brazil — [email protected]