Dodo Password Manager — Privacy Policy

This Privacy Policy specifically governs the Dodo Password Manager Chromium Extension distributed via the Chrome Web Store. DodoDeck is committed to user privacy through local-first and client-side zero-knowledge cryptography.

1. Zero-Knowledge Architecture

All passwords, credentials, notes, and WebAuthn passkeys are encrypted and decrypted locally on your device using military-grade AES-256-GCM encryption with keys derived via 600,000 PBKDF2 iterations. Your master password and plaintext credentials never leave your browser unencrypted and are never transmitted to, stored on, or viewable by DodoDeck servers or any third parties.

2. Single Purpose Policy

Dodo Password Manager serves the single purpose of securely generating, storing, managing, and autofilling passwords and W3C WebAuthn passkeys across user-visited web pages.

3. Data Collection and Usage

• User Email Address: Collected solely to establish account identity, dispatch 6-digit confirmation codes via transactional email, and synchronize the user's encrypted vault partition across authorized devices.
• Encrypted Vault Data: Only encrypted ciphertext is stored in our database. Without your client-side master password, this data cannot be read, decrypted, or viewed by anyone.
• WebAuthn Passkeys: Passkeys are created and signed directly in your browser. Cryptographic private keys remain strictly encrypted in your local vault.

4. Information We NEVER Collect

• We never collect, monitor, track, or record your web browsing history or search queries.
• We never sell, rent, monetize, or trade your personal information or vault contents to third parties, advertising networks, or data brokers.
• We never log keystrokes or inspect input fields outside of user-prompted credential autofilling.
• We never inject third-party advertisements, affiliate tags, or cryptocurrency miners.

5. Chrome Web Store Permissions Justification

• storage & unlimitedStorage: Required to persist the user's encrypted credential database and settings locally within the browser sandbox without quota limitations.
• tabs & activeTab: Required to inspect the domain of the active web page to automatically match and present saved credentials for that specific site.
• Host Permissions (<all_urls> / Content Scripts): Required to detect login/registration form fields across arbitrary websites, render the floating inline autofill menu, and handle WebAuthn passkey registration (navigator.credentials.create) and assertion (navigator.credentials.get).
• alarms: Used under Manifest V3 service workers to enforce configurable vault auto-lock timers and perform periodic encrypted synchronization.

6. Data Ownership and Deletion

You maintain full control and ownership of your vault. You may export an encrypted backup file of your entire database at any time from extension settings. If you delete your account, your encrypted cloud record is permanently erased.

7. Contact Us

If you have any questions or security inquiries regarding this policy, please reach out via our official support channel: https://dododeck.com/pages/contact