Posternbolt privacy policy

Publisher: Zydeno. Contact: [email protected]. Effective 3 November 2026.

Posternbolt stores two-factor keys on your device. It has no account and no server. Persistent extension data stays in your browser (storage.local); an unlocked session also uses the browser's memory (storage.session). Nothing is sent to Zydeno or anyone else, and there are no analytics. The extension makes no network requests. If a store page link is shown in Help, it opens only when you click it.

What is stored

• Encrypted vault in storage.local: service names, logins, secret keys, code settings, folders, and the date and counters of your last backup. All of this is encrypted with AES-256-GCM, using a key derived from your password with PBKDF2-SHA-256 (600,000 iterations, random salt). Next to it, not encrypted: the salt, the initialisation vector, the format version, and your settings (auto-lock time and theme).
• Session key in storage.session: while the vault is unlocked, the derived key is kept here so you do not have to retype the password each time you open the popup. The browser keeps this area in memory and clears it on restart. The extension removes it when the vault locks.
• Your password is not written to persistent extension storage. Passwords and decrypted data are processed in browser memory; the extension does not guarantee secure erasure of that memory.

Backup files

A backup is made only when you ask, and it is saved where your browser saves downloads. It is encrypted with the password you choose for it. Zydeno never sees it.

Permissions

• storage: keeps the encrypted vault, the settings and the session key.
• activeTab: when you click the toolbar button and choose to read the page, the extension captures the visible part of that one tab once, finds a QR code in the picture, and discards the picture. It is not saved or sent. No other page is read.
• alarms: runs the auto-lock timer.

The extension has no access to all sites and injects no scripts into pages. Pictures you open on the Add page are read in that tab and are not stored either.

What this does not protect against

Encryption protects the stored data, not a computer that is already compromised. While the vault is unlocked, malware on the computer or someone using it could reach your codes. A weak password is easier to guess if someone copies the stored data. Copied codes stay in the clipboard until something replaces them; the extension does not clear it.

Deleting your data

Erase the vault in Settings, or uninstall the extension. Browsers delete extension storage on uninstall. The extension offers no undo for erasing the vault. Zydeno has no password reset or vault recovery service. A saved backup can restore accounts if you know its password. Backup files you saved are yours to delete; erasing the vault does not delete them. This is not a promise of forensic erasure from disk or browser memory.

Children

The extension is not directed at children and collects no data from anyone.

Changes

A changed policy will be published at this address with a new date.