ClawVault is a zero-knowledge credential manager. The single most important fact in this policy: your secrets are encrypted and decrypted only on your own device. ClawVault's servers never see your passwords, and there is no way for us to read them — by design, not by promise.
The short version
- We cannot read your stored passwords, notes, or other vault secrets.
- The server stores only opaque encrypted blobs plus the encrypted key material needed to unlock them on your device. There is no server-side "decrypt" or "reveal" endpoint.
- The decryption key is derived on your device from your master password (and, optionally, unlocked by your device's biometric/PIN authenticator). It lives only in your browser's in-memory session storage and is erased when you lock the extension or close your browser.
- We do not sell your data, and we do not use it for advertising or any purpose unrelated to running ClawVault.
What the extension stores, and where
| Data | Where it lives | Can the server read it? |
|---|---|---|
| Your vault secrets (logins, passwords, etc.) | Encrypted ("sealed") on the server as opaque blobs; decrypted only in your browser's memory | No |
| Your master password | Read once in your browser at unlock, used to derive the key, then discarded. Never transmitted, never stored. | No — never leaves your device |
| Data Encryption Key (DEK) | In your browser's in-memory chrome.storage.session only; zeroed on lock; never written to disk | No |
| Biometric quick-unlock material (optional) | An encrypted ("wrapped") copy of your DEK in local extension storage, openable only by a live assertion from your device's platform authenticator. Useless at rest. | No |
| Your ClawVault session token | Cached in your browser's in-memory session storage to authenticate requests | The token only grants access to your opaque encrypted blobs; it cannot decrypt them |
How decryption works (why we can't see your secrets)
- You sign in. A session token authorizes the extension to download your encrypted blobs.
- You enter your master password. Your browser derives a key (Argon2id) and unwraps your Data Encryption Key locally. A wrong password fails the local integrity check — nothing is sent anywhere.
- The extension decrypts items in your browser and fills them into the page. The decrypted value never returns to any server.
Optional biometric quick-unlock
If you enable it (off by default; requires a successful master-password unlock first), the extension stores an extra encrypted copy of your Data Encryption Key locally, wrapped with a key produced by your device's platform authenticator (Touch ID / Windows Hello / a device PIN, via WebAuthn). This stored copy is meaningless without a live, on-device authenticator assertion. Your master password remains the canonical unlock method and fallback.
Optional statement capture (financial documents)
The extension can also save your own account statements into your ClawVault, so you can track your finances without giving any third party your bank login.
- It only runs when you click "Capture statement from this tab." Nothing is read or sent in the background; there is no automatic scanning.
- On a page where you are already signed in to your bank, it looks on that one page for the statement file (a PDF or CSV), downloads it using your own logged-in browser session (the extension never sees or stores your bank password — you are already authenticated), and uploads that file to your ClawVault account to be parsed into your transactions.
- Only the statement file you captured is sent, to ClawVault's own import endpoint (
go-claw.com), authenticated with your ClawVault session token, over HTTPS. It goes to your account and is not shared. - Your bank username/password is never handled, and pages you do not explicitly capture are never read. This is the same import as uploading a statement by hand in the ClawVault app.
Permissions and why each is needed
storage— hold the encrypted key material and in-memory session state.activeTab/scripting— fill credentials into the page you are using (on "Fill"), and capture a statement from the page you are viewing (on "Capture statement"). Both act only on your explicit click.alarms— enforce the automatic idle lock (the key is dropped after inactivity).- Host access to web pages — autofill works on any site where you keep a login, and statement capture on any bank/card site you use. The content script does not read or transmit page contents in the background — only the credential you fill or the statement you capture.
- Host access to
go-claw.comand the ClawVault backend — sign in, download your encrypted blobs, and upload a statement you choose to capture.
Data sharing and selling
We do not sell your personal data and do not share it with third parties for advertising or unrelated purposes. The only network destinations the extension contacts are ClawVault's own services (go-claw.com and the ClawVault backend) for authentication, encrypted-blob sync, and the statements you choose to capture, over HTTPS. Captured statements live in your own ClawVault account under the same retention/deletion controls as the rest of your data.
Data retention and deletion
Your encrypted vault blobs are retained while your account is active. You can delete items, or your entire account, from the ClawVault app; deleting an item removes its encrypted blob from the server. Because the server never holds your decryption key, deleting your account leaves no recoverable plaintext anywhere.
Contact
Questions about this policy or your data: [email protected]
This policy applies to the ClawVault — Autofill browser extension for Chromium-based browsers (Chrome, Edge, Brave, Arc) and Firefox.