Skip to content

Privacy Policy for StepAway Extension

Jump to bottom
Thalapathi-TR edited this page Jul 26, 2026 · 1 revision

Privacy Policy for StepAway

Effective Date: July 26, 2026
Extension Name: StepAway - Single Domain Session Lock

1. Overview

StepAway ("the Extension") is committed to protecting user privacy. StepAway is designed as a browser-scoped deterrent security tool that operates entirely locally on your device. We do not collect, transmit, track, or sell any personal information or browsing history.

2. Information Collection and Usage

No Data Collection

StepAway does NOT collect, store, transmit, or share any personal data, IP addresses, browsing history, web activity, or analytics.

Local Device Storage Only

All extension data is stored strictly locally on your browser using Chrome's chrome.storage.local API. This data includes:

  • Salted Master Password Hash: SHA-256 salted hash of your chosen master password (plain-text passwords are NEVER stored).
  • Emergency Recovery Code Hash: SHA-256 salted hash of your generated recovery code.
  • Extension Settings: User preferences such as audio alert toggles, screen shake options, auto-expire timer settings, and whitelist configurations.
  • Active Lock State: Current domain lock status and locked domain URL.

None of this information ever leaves your device or browser container.

3. Chrome Permissions & Usage

StepAway requests only the minimum necessary permissions to perform its core single-domain session locking functionality:

  1. storage: Used exclusively to save extension configuration, preferences, and salted password hashes locally in chrome.storage.local.
  2. tabs: Used to identify the active website domain when initiating a lock, close unauthorized open tabs when locking, and redirect blocked navigation back to the permitted domain.
  3. declarativeNetRequest: Used to block web requests to non-permitted domains dynamically while session locking is engaged.
  4. alarms: Used to handle background auto-expire timers to automatically lift session locks after a user-selected time limit.
  5. host_permissions (<all_urls>): Required to enforce dynamic domain blocking across any website the user chooses to lock to.

4. Third-Party Access and Data Sharing

StepAway does not integrate any third-party analytics, tracking scripts, advertising networks, or remote API services. No data is shared with third parties under any circumstances.

5. Security

StepAway utilizes modern cryptographic standards (SHA-256 with unique random salt) to protect your master password and emergency recovery code locally. Passwords are never stored in plain text.

6. Updates & Contact

This Privacy Policy may be updated to reflect changes in Chrome extension policies or extension functionality.

If you have any questions or concerns regarding this Privacy Policy, please contact qubitz24@gmail.com.

Clone this wiki locally