VaelMask extension privacy policy

1. Information handled by VaelMask

1. Authentication tokens: When you connect VaelMask to VaelMail, the extension generates a secure device authorization request. Upon your approval, a scoped bearer token and rotating refresh token are stored in your browser's private extension storage (browser.storage.local). These tokens are used exclusively to communicate with https://vaelmail.com/api/vaelmask/*.
2. Domain-to-alias associations: When you generate or assign an alias for a website (e.g., example.com), that domain name and the associated alias identifier are stored locally on your device in extension storage. Your browsing history is never collected, uploaded, or transmitted to VaelMail or any third party.
3. Verification email text: When you actively monitor an alias for verification, VaelMask polls or subscribes to real-time delivery notifications for that specific alias. VaelMail extracts code suggestions and relevant verification links on the server. The extension displays message text temporarily in the requesting page and does not save full email bodies in extension storage. Waiting starts after the alias form is submitted, or when you choose to start it manually.
4. Disabled site preferences: If you disable VaelMask on a specific domain, that preference is stored strictly in local browser storage.

2. Information never collected

• We do NOT collect, store, or sell personal browsing history, search queries, or page contents.
• We do NOT include third-party tracking libraries, analytics SDKs, session replay tools, or advertising pixels.
• We do NOT read passwords, payment card numbers, or form inputs outside of email fields when generating aliases.
• The selected-alias mail endpoint enforces account ownership and delivered-recipient filtering. Connection access permits reading messages delivered to account aliases, not only messages containing verification codes. Connect only a trusted copy of VaelMask.

3. Data storage & security

Connection tokens, website assignments, and disabled-site preferences use storage.local. Pending verification and up to 15 recent codes with sender, subject and website context use memory-backed storage.session. Codes have a ten-minute lifetime; expired entries are excluded and pruned on access. Disconnect clears local tokens, assignments, pending verification and codes, while keeping disabled-site preferences. Browser shutdown clears session storage. Requests to VaelMail use HTTPS. Disconnect also requests server revocation; if it cannot be confirmed, revoke the connection in Account Security.

4. Contact & inquiries

For questions or security disclosures regarding VaelMask or VaelMail, contact:

• Email: vael-support@vael.email
• Website: VaelMail contact and support