Privacy Policy — Absolute Zero Toolbox

Absolute Zero Toolbox is a developer toolkit that runs entirely on your own device. There is no Absolute Zero account, no Absolute Zero server, and no backend operated by the developer. The developer does not receive, store, or have any access to your data.

This policy describes, in full, what data the extension collects, how it is handled, how and where it is stored, and the circumstances in which it is shared with third parties.

The extension collects and processes the following categories of user data. All of it is collected locally on your device, and only as a direct result of an action you take.

The extension does not collect, and has no capability to collect, any of the following:

• Personally identifiable information such as your name, address, email address, age, or an identification number
• Health information
• Financial or payment information
• Your personal communications
• Your location or GPS coordinates
• Your web browsing history or a record of the pages you visit
• User activity analytics such as clicks, mouse position, scroll behaviour, or keystrokes

The extension contains no analytics, no telemetry, no tracking pixels, and no advertising software of any kind.

All processing happens locally, inside your browser, on your own device.

• Authentication information is used solely to generate two-factor codes on screen and to display snippets you saved. Your master password is never stored anywhere. It is used to derive an encryption key using PBKDF2-SHA256 with 310,000 iterations, and that key exists only in memory while the vault is unlocked.
• Website content is read into memory, used immediately to complete the action you requested, and then discarded. It is not written to disk, indexed, profiled, or retained after the tool finishes, except where you explicitly save a result such as a scan report.
• Preferences and working data are used only to restore your setup and your saved work when you reopen the extension.

The developer has no access to any of this data at any point. It is never sent to the developer, and no infrastructure exists that could receive it.

All storage is local to the Chrome profile where it was created. Nothing is synced to the developer, and nothing is stored on any server operated by the developer.

The developer does not share your data with anyone, because the developer never receives it.

Data leaves your device only when you personally use a feature that requires the network, and then only to the destination that feature names. The complete list of parties that may receive data, and exactly what they receive, is below.

These services receive only the minimum needed for that specific tool to work. Your vault contents, master password, and stored secrets are never sent to any of them.

QR codes are generated locally on your device. No image service is contacted.

If you never use these features, the extension makes no network requests at all.

Site Insights is switched off unless you explicitly enable it in Settings. While it is off, its script is not loaded into any web page.

When you enable it, the extension samples the current page locally to detect signals such as sandbox payment keys, staging or preview hostnames, and development build fingerprints, and may show a small in-page notice. The sampled content is analysed entirely in your browser and is never uploaded to anyone. You can dismiss a notice, mute it for a specific site and rule, clear those dismissals, or switch the feature off at any time.

Because all data stays on your device, you control its lifetime completely.

• Vault contents are retained until you delete them. Deleted items go to a trash area for seven days and are then permanently purged. You can purge them immediately.
• Website content is not retained. It is discarded as soon as the tool you ran finishes, unless you explicitly save a result.
• Preferences and working data are retained until you clear them.
• Scan history and tool storage can be cleared independently from Settings at any time.
• Everything can be exported or wiped from Settings, and uninstalling the extension removes all of its stored data from that Chrome profile.

The developer cannot delete your data on your behalf, because the developer never holds it.

• We do not sell or transfer user data to third parties, other than in the approved cases described in section 6, where transmission is necessary to deliver a feature you explicitly requested.
• We do not use or transfer user data for any purpose unrelated to the extension’s single purpose.
• We do not use or transfer user data to determine creditworthiness or for lending purposes.
• We do not use user data for advertising, profiling, or tracking of any kind.

Vault contents are encrypted at rest using AES-256-GCM. The encryption key is derived from your master password using PBKDF2-SHA256 with 310,000 iterations and a random per-installation salt. The master password itself is never stored, and the derived key is held only while the vault is unlocked.

Because encryption is tied to a password only you know, there is no recovery mechanism. If you forget your master password, the vault cannot be decrypted by anyone, including the developer.

• storage — save the encrypted vault and your preferences
• sidePanel, tabs, activeTab, scripting — run the side panel interface and let tools act on the tab you choose
• cookies — Storage Manager cookie editing and Exposure Scanner cookie checks
• debugger — used only by the Interceptor tool, and only on a tab you explicitly attach it to. Chrome displays its own banner the entire time it is active, and detaching ends it
• declarativeNetRequest — set request headers for CORS and header probes that you initiate
• clipboardRead, clipboardWrite — copy codes and results, paste tokens, and support the optional clipboard auto-clear timer
• alarms — lock the vault automatically after inactivity
• contextMenus — the right-click “Fill this Form” and “Fill this Field” shortcuts
• Access to websites — the HTTP tools must reach whatever URL you type, which cannot be known in advance, and the page tools must act on the tab you select. This access is used only for the action you requested

This extension is a developer tool intended for professional use. It is not directed at children under 13 and does not knowingly collect data from them.

If this policy changes materially, the “Last updated” date above will change and the revised policy will be published at this URL before the change takes effect in a released version of the extension.