Alsalibi AI · Extension 1.3.1

Privacy

Updated 6 November 2026. Contact: info@alsalibi.de.

Website logins, Wi-Fi passwords, private notes and saved links are encrypted on your device before synchronization with Alsalibi Cloud.

Encrypted data and connections

Titles, usernames, passwords, URLs, notes, favorites and item-type settings are contained in the encrypted vault document. The Cloud API receives that ciphertext, account and vault identifiers, a revision and encryption metadata. Your master passphrase and decrypted vault key are not sent to that API. A one-use connection code creates a dedicated, revocable browser token; the extension does not ask for your Cloud account password.

Local and session storage

Trusted extension local storage contains the encrypted envelope, connection token, language, lock settings and backup preferences/status. The browser token is stored separately from the encrypted document. The popup unlock key stays in trusted session memory and is removed when that popup session locks. Chrome clears session storage on browser restart or extension update/reload. The remembered policy can lock on popup close, on closing all normal Chrome windows, or after inactivity. Manual mode has no inactivity timer during the current Chrome session; it is not permanent disk-based auto-unlock. Optional screen-lock detection uses Chrome's idle API only after you enable it and approve its permission.

Optional Cloud website session grant

A packaged content-script bridge runs only in the top-level page on https://cloud.alsalibi.de. It does not read login forms or expose the popup vault's key. When you explicitly select Cloud's browser-close unlock policy with this extension already paired to the same account and vault, Cloud may send its own already-unlocked data key to the extension's trusted session memory. The bridge accepts only the fixed Cloud origin and validates the account, vault, scope and unexpired browser connection. The supplied key is checked against the paired encrypted vault before a separate website grant is saved.

This grant stores only the key and its binding metadata in trusted browser-session memory, never in persistent extension storage or a website disk cache. It lets the same Cloud account restore its vault after a page reload while Chrome remains open. Cloud's explicit Lock or sign-out, extension global Lock/disconnect, connection expiry, the last normal Chrome window closing, browser startup and extension reload/update revoke the grant. Automatic popup inactivity/close locking does not itself revoke a separately selected Cloud website policy. A Cloud manual-only page session stays in the page's memory and is lost on page reload/close. Neither mode promises to remain unlocked until computer shutdown after a full browser restart; that requires a separate desktop service.

Website prompts and account badges

Opening the extension grants temporary active-tab access. Optional HTTPS access can be granted to enable save/fill prompts and current-site badges. Packaged content scripts detect supported visible login fields and whether they contain values to offer a Save prompt. Only clicking Review and save asks the worker to capture the visible supported form. The draft remains in trusted session memory for up to 90 seconds, is bound to the account, vault, tab and HTTPS origin, and is cleared when consumed, expired, the popup closes, or you lock/disconnect or revoke access. It is not persisted as plaintext. Final vault saving requires your explicit review and Save action.

Badges count only exact-origin website logins and show no account count while locked. Website addresses are processed locally for matching; the extension does not persist a browsing-history index. Wi-Fi passwords and secure notes are excluded from website filling and badge counts. Filling requires a selected account and never submits the login form. The selected website can observe credentials you deliberately fill into its own form.

Imports, clipboard and checks

A selected Chrome CSV export is parsed and previewed locally. Imported items are encrypted before synchronization; the original CSV is plaintext and should be deleted after successful migration. This is a user-initiated import, not live access to Google's password vault. The extension does not read operating-system Wi-Fi passwords. Local password-health checks inspect website-login length and exact reuse; no online breach service receives your passwords. Explicit Copy writes the selected secret to the system clipboard; locking the extension does not clear that clipboard.

Cloud backups and operation

Normal synchronization sends encrypted envelopes to cloud.alsalibi.de; the legacy drive.alsalibi.de origin remains supported for older connections. Additional backups are complete encrypted snapshots in the dedicated Passwords folder. Automatic snapshots are off by default and checked during use at the chosen interval. Editing/deleting an active entry does not remove older snapshots. Cloud receives operational metadata needed to serve requests, such as source IP, request path, status and time. Contact support for operational retention and account-data requests.

The extension contains no advertising or third-party analytics code. Vault information is used for the disclosed password-manager functions and necessary operation/security, not for advertising or sale.

Your controls

You can lock, disable optional site prompts, change settings, edit/delete entries, export encrypted backups and disconnect a browser. Disconnect removes its local cache/token; revoke the connection in Cloud to invalidate the server token. Other devices and downloaded backups may retain copies. A backup requires the passphrase in use when it was created. Keep your recovery information safe; stored ciphertext alone does not reveal a forgotten master passphrase.