Privacy Policy

Not Login Chrome Extension  ·  Last updated: July 16, 2026

Not Login ("the Extension") is a Chrome extension that lets you store and retrieve physical-world secrets — such as Wi-Fi passwords, bank PINs, door codes, and API keys — using your own Google Sheet as a backend. This policy explains what data the Extension accesses, how it is used, and what it never does.

1. Data We Do Not Collect

The Extension does not operate any server, database, or backend of its own. No personal data, credentials, usage statistics, or analytics are ever transmitted to the developer or any third party.

2. Data Stored Locally

• Vault reference (the Google Drive file ID of your vault spreadsheet) is stored in chrome.storage.sync, which syncs across your Chrome browsers signed into the same Google account. No secret data is stored here — only the pointer to your vault.
• Extension preferences (e.g. autofill toggle) are stored in chrome.storage.local on your device and never leave your browser.
• Session cache — a temporary copy of your secrets fetched from Google Sheets — is stored in chrome.storage.session and is automatically cleared when Chrome closes.

3. Google Account & Google Sheets Access

The Extension uses Google OAuth 2.0 (chrome.identity) to authenticate you and obtain an access token. This token is used solely to read from and write to the specific Google Sheet you configure. The Extension requests the https://www.googleapis.com/auth/drive.file scope in order to:

• Create your vault spreadsheet in Google Drive on first setup
• Read your secrets from your vault spreadsheet
• Append new secrets to your vault spreadsheet
• Update existing rows in your vault spreadsheet
• Delete rows from your vault spreadsheet
• List previously created vaults to support recovery on a new device

The drive.file scope grants access only to files created by the Extension or explicitly authorized by you — never your entire Google Drive. Your secrets remain exclusively in your own Google Account.

4. Clipboard

When you click a secret field to copy it, the value is written to your system clipboard using the clipboardWrite permission. This action is initiated solely by you and no clipboard data is transmitted anywhere.

5. Autofill (Content Script)

On HTTPS pages, the Extension injects a small icon next to password fields to offer autofill suggestions for secrets you have stored with type=website. The content script only reads secrets from the local session cache; it does not transmit any page content or form data to any server.

6. Permissions Justification

• identity — Required for Google OAuth authentication.
• storage — Required to save settings and the session cache locally.
• activeTab — Required to determine the current page's domain for autofill matching.
• clipboardWrite — Required to copy secrets to the clipboard on user request.
• host_permissions: https://sheets.googleapis.com/* — Required to call the Google Sheets API.
• host_permissions: <all_urls> — Required for the content script to inject the autofill icon on any HTTPS website.

7. Sharing, Transfer, and Disclosure of Google User Data

The Extension does not share, sell, transfer, or disclose any Google user data — including your Google Account identity, OAuth tokens, or the contents of your Google Sheet — to the developer, any third party, or any other service. Your data flows only between your browser and Google's own APIs (sheets.googleapis.com and Google's OAuth endpoints). No other third-party services receive any data.

8. Data Protection Mechanisms

Your secrets are protected by multiple layers of security:

• Stored in your Google Account — secrets reside in a Google Sheet you own, protected by Google's security infrastructure and your own account credentials.
• OAuth 2.0 via Chrome Identity API — authentication tokens are managed exclusively by Chrome's built-in chrome.identity system; the Extension never stores or touches raw credentials.
• Local session cache only — secrets fetched from Google Sheets are temporarily cached in chrome.storage.session, which is sandboxed to the extension and inaccessible to web pages or other extensions.
• No transmission outside Google — your data is never sent to any server other than Google's own APIs.
• HTTPS only — all API requests to Google are made over HTTPS.

9. Data Retention and Deletion

• Session cache — the temporary copy of your secrets held in chrome.storage.session is automatically cleared when Chrome is closed. It expires after 5 minutes of inactivity even within a session.
• Vault reference (the Drive file ID of your vault) stored in chrome.storage.sync persists and syncs across your Chrome browsers until you uninstall the Extension or clear it manually.
• Google Sheets data — your secrets remain in your own Google Sheet for as long as you choose to keep them. You can delete individual rows, clear the entire sheet, or delete the spreadsheet at any time from Google Sheets.
• Revoking access — you can revoke the Extension's access to your Google Account at any time at myaccount.google.com/permissions. This immediately invalidates the OAuth token and prevents further API access.

11. Children's Privacy

The Extension is not directed at children under the age of 13 and does not knowingly collect any information from children.

12. Changes to This Policy

If this policy is updated, the "Last updated" date at the top of this page will be revised. Continued use of the Extension after any change constitutes acceptance of the new policy.

13. Contact

For questions about this privacy policy, please open an issue on the project repository or contact the developer directly.