Privacy Policy — My SPACE

Data Collection

My SPACE does not collect, transmit, or share any personal data. All data you enter — notes, secrets, subscriptions, to-do items, and map pins — is stored exclusively on your local device using Chrome's built-in storage APIs.

No information is sent to any server operated by the extension developer, now or in the future. There are no accounts to create and no sign-up forms to complete.

✕ No analytics

✕ No tracking

✕ No accounts

Local-only storage

Encryption

All vault data is encrypted on-device using the Web Crypto API (AES-GCM) with your master passphrase before being stored. Your passphrase never leaves your device.

Encryption keys are derived via PBKDF2 with SHA-256 and a unique random salt per installation. Each individual secret uses its own random initialisation vector so no two ciphertexts are identical, even for identical plaintext.

The derived key exists only in memory for the duration of your session and is immediately wiped when you lock the vault.

AES-GCM · PBKDF2 · Zero servers

Algorithm AES-GCM 256-bit

Key derivation PBKDF2 · SHA-256

IV Random per secret

Web API Web Crypto (native)

Key storage Memory only

Server access None

Google Drive Sync (Optional)

If you choose to enable Google Drive sync, your data is encrypted locally before upload. The ciphertext that reaches Google Drive is opaque — Google cannot read it, and neither can the extension developer.

The extension only requests access to Google Drive's private appData folder. This folder is isolated and not visible to other apps, other users, or anyone browsing your Drive. You may revoke this access at any time from your Google Account permissions page.

No data is sent to any server operated by the extension developer at any point during the sync process.

appData folder only. My SPACE never reads, writes, or lists any files outside its dedicated private appData scope. Your existing Drive files are fully untouched.

Permissions

Permissions requested by this extension are used solely to provide its core functionality. No permission is used for tracking, analytics, or advertising purposes.

storage — Persists your notes, vault, to-dos, subscriptions, and map pins locally in Chrome's storage API.
sidePanel — Renders the extension UI as a persistent side panel without requiring a dedicated browser tab.
identity — Used exclusively to authenticate with Google OAuth when you opt in to Drive sync. No other identity data is accessed.
activeTab / scripting — Enables the floating "Pin to My SPACE" button on map pages and the save-prompt on login forms. Only triggered on the active tab, only when you interact with the extension.
alarms — Schedules local reminders for subscription renewal dates. No network calls are made.

Third Parties

This extension does not use any analytics, crash reporting, or advertising services. No data is shared with third parties under any circumstances.

The only external service My SPACE communicates with is Google Drive, and only when you explicitly enable sync. That communication is limited to your private appData folder and carries exclusively encrypted data that the extension developer cannot read.

✕ No analytics SDKs

✕ No crash reporters

✕ No ad networks

Google Drive (optional, encrypted)

Contact

For questions or concerns about this privacy policy, please reach out directly.

Email

cuongquachc88@gmail.com