Privacy Policy

Stash Chrome Extension — Last updated: May 31, 2026

Overview

Stash is a Chrome extension that captures full-page browser screenshots with embedded metadata for verification and optional import into Stash for Mac. This policy explains what data the extension accesses, how it is used, what stays local, and what is transmitted for server attestation.

Data the Extension Accesses

When you click the capture button, Stash accesses the following from the active tab:

• Page URL and title — embedded in the screenshot metadata for the active capture
• Visible tab content — captured as screenshot tiles and stitched into one or more PNG files
• Viewport dimensions and device pixel ratio — used for accurate tile stitching
• Page height and capture part fields — used to split long captures into ordered PNG parts
• Page DOM — read only to compute a SHA-256 hash for verification. The raw DOM is never stored, copied, or sent to Stash servers.
• Generic visible page context — when visible in common page elements, the extension may read headings, breadcrumbs, workspace names, or account/page labels

The extension only accesses tab content when you explicitly click the capture button. It does not run in the background, monitor browsing activity, read unrelated tabs, collect form values, read cookies, read localStorage or sessionStorage, collect passwords, collect authentication tokens, or inspect network request/response bodies.

Data Stored Locally

• ECDSA P-256 signing keypair — generated once on install and stored in chrome.storage.local. Used to sign screenshot metadata. Never transmitted.
• Last capture timestamp — stored locally for the popup status display.
• Downloaded screenshot PNG parts — saved to your Downloads folder as stash-*.png files so Stash for Mac can import them into History.

The extension does not store browsing history. Screenshot files are stored only as local downloads created by your explicit capture action.

Clipboard

The generated PNG may be copied to your system clipboard after you click the Stash capture button, so you can paste it immediately into other apps. Clipboard writes happen only after a user-initiated capture.

Data Transmitted

When server attestation is available, the following data is sent to the Stash attestation server for timestamping:

• SHA-256 hash of the image pixel data
• SHA-256 hash of the page DOM
• Page domain and URL
• Client-side timestamp
• Attestation ID (a random UUID)
• Extension ID

The attestation server does not receive:

• The actual screenshot image
• The page HTML content
• Page text, account names, organization names, form values, cookies, local storage, session storage, authentication tokens, or passwords
• Browsing history or any data from other tabs

The server returns a signed timestamp and public key. The attestation request is used only to provide verification metadata for the capture.

Third-Party Services

The attestation server may query crt.sh (a public Certificate Transparency log) for TLS certificate fingerprints associated with the captured page's domain. This is a public certificate lookup.

No Accounts, No Analytics

• No user accounts or sign-in required
• No extension analytics, telemetry, or usage tracking
• No cookies or tracking pixels
• No advertising

Data Sharing

The extension does not sell, share, or transfer user data to any third party for advertising, marketing, or any purpose unrelated to the extension's core functionality (screenshot capture and attestation).

Permissions Explained

• activeTab — capture the visible tab as a screenshot and read the URL/title
• clipboardWrite — copy the generated screenshot PNG to your system clipboard after you click capture
• downloads — save the screenshot PNG to your Downloads folder
• offscreen — provide the hidden document Chrome requires for clipboard writes from a Manifest V3 extension
• scripting — inspect the active page layout, scroll the page, collect low-risk page context, and support full-page capture after you click capture
• storage — persist the local signing keypair and last capture timestamp across browser sessions

Changes to This Policy

If this policy is updated, the changes will be reflected here with an updated date. Significant changes will be noted in the extension's changelog.

Contact

For questions about this privacy policy or the extension's data practices, contact chris@yourstash.ai.