Privacy Policy — Absolute Zero Toolbox

Absolute Zero Toolbox is a privacy-first, on-device developer toolkit. Your vault is encrypted locally on your own machine. There is no Absolute Zero account, no Absolute Zero server, and no backend that receives your vault contents, master password, TOTP secrets, browsing history, or scan findings. We do not use analytics, tracking pixels, or advertising SDKs, and we do not sell or share personal data.

All of the above stays on the Chrome profile where it was created. It is not synced to us. Uninstalling the extension removes this data for that profile. You can also export or wipe vault data from Settings at any time.

Some tools read the page you are on — for example Storage Manager, Exposure Scanner, Form Filler, and the optional Site Insights feature. This reading happens locally, in your browser, only when you run that tool. Page content is never transmitted to Absolute Zero. There is no Absolute Zero server to transmit it to.

Data leaves your browser only when you personally use a feature that requires the network, and it goes to the destination that feature names — never to us:

• API Tester, Race Conditions, CORS Tester, HTTP Headers, cURL Importer, Interceptor — send requests to the URLs that you enter.
• Exposure Scanner — fetches pages and paths on the site you explicitly choose to scan. Only use it on sites you own or are authorised to test.
• Temp Mail — creates and reads a disposable inbox using the third-party service mail.tm. Messages in that inbox are handled by mail.tm under their own privacy policy.
• Webhook Inbox — creates a temporary callback URL using the third-party service webhook.site. Anything sent to that URL is visible to webhook.site under their own privacy policy.
• DNS Lookup — resolves the hostname you enter via DNS-over-HTTPS using Cloudflare (cloudflare-dns.com) and/or Google (dns.google).
• TLS Peek — queries public Certificate Transparency data (crt.sh) for the hostname you enter.
• IP Info — looks up geolocation and ASN for the IP or hostname you enter using a public IP API (ipapi.co). This is opt-in; your own IP is only looked up if you explicitly ask for it.

QR codes are generated locally on your device; no image service is contacted.

These third-party services receive only what that specific tool needs to work (for example, the hostname you typed). We do not send them your vault data, and we receive nothing back about you.

Site Insights is disabled unless you turn it on in Settings. Its page-scanning script is not even loaded into web pages while it is off. When you enable it, the extension samples the current page locally to spot signals such as Stripe test keys, staging or preview hostnames, and common development build fingerprints, and may show a small in-page notice. The sampled content is analysed in your browser and is not uploaded anywhere. You can dismiss a notice, mute it per site and rule, clear muted dismissals, or switch the feature off entirely.

• storage — save the encrypted vault and your preferences
• sidePanel, tabs, activeTab, scripting — run the side panel interface and the tools that act on the tab you choose
• cookies — Storage Manager cookie editing and scanner cookie checks
• debugger — used only by the Interceptor tool, and only for the tab you explicitly attach it to. Chrome displays its own banner whenever this is active. Detaching ends it.
• declarativeNetRequest — set request headers for CORS and header probing that you initiate
• clipboardRead, clipboardWrite — copy codes and findings, paste tokens, and support the optional clipboard auto-clear timer
• alarms — auto-lock the vault after inactivity
• contextMenus — the right-click “Fill this Form / Field” shortcuts
• Access to websites — HTTP tools need to reach the arbitrary URLs you type, and page tools need to act on the tab you pick. This access is used for the action you requested and nothing else.

• Lock or auto-lock the vault
• Export or wipe vault data from Settings
• Change the master password
• Clear scan history and tool storage independently
• Enable or disable Site Insights
• Hide or pin tools
• Uninstall to remove all extension data for that profile

This extension is a developer tool and is not directed at children under 13.

If this policy changes materially, the “Last updated” date above will change and the updated policy will be published at this URL before the change takes effect in a released version.