Stash Chrome Extension — Last updated: October 15, 2026
Stash is a Chrome extension that captures full-page browser screenshots with embedded metadata for verification and optional import into Stash for Mac. With Smart Paste (Beta) turned on, it also fills web forms with answers you saved in Stash for Mac. This policy explains what data the extension accesses, how it is used, what stays local, and what is transmitted for server attestation.
When you click the capture button, Stash accesses the following from the active tab:
The extension only accesses tab content when you explicitly click the capture button. It does not run in the background, monitor browsing activity, read unrelated tabs, collect form values, read cookies, read localStorage or sessionStorage, collect passwords, collect authentication tokens, or inspect network request/response bodies. Smart Paste (Beta) is separate and runs only when you use it; see the Smart Paste (Beta) section below.
chrome.storage.local. Used to sign screenshot metadata. Never transmitted.stash-*.png files so Stash for Mac can import them into History.The extension does not store browsing history. Screenshot files are stored only as local downloads created by your explicit capture action.
The generated PNG may be copied to your system clipboard after you click the Stash capture button, so you can paste it immediately into other apps. Clipboard writes happen only after a user-initiated capture.
When server attestation is available, the following data is sent to the Stash attestation server for timestamping:
The attestation server does not receive:
The server returns a signed timestamp and public key. The attestation request is used only to provide verification metadata for the capture.
Smart Paste fills a web form with answers you saved in the Stash app on your Mac. It is off until you turn it on. Chrome then asks you once to let Stash “communicate with cooperating native applications”. That native application is the Stash app on your own computer.
What the extension reads. Smart Paste runs only when you press its keyboard shortcut or click Smart Paste (Beta) in the Stash menu. It reads the empty fields of the form on that page: their labels and names, the choices in drop-down lists, and whether each checkbox is ticked. It also reads the page’s address and main heading. It never reads what you have already typed, and it never changes a field you have filled in.
Where that goes. The extension passes that description of the form to the Stash app on your Mac through Chrome’s native messaging, which stays on your computer. The extension itself sends nothing about the form over the internet, unless you choose Report this form (below).
Matching fields to your answers. To decide which saved answer belongs in which field, the Stash app sends Jev, an AI service operated by TypeSafe, the following, through Stash’s server:
Your saved answers themselves are never sent. If a saved answer happens to appear in a label, it is replaced with “[omitted]” before anything is sent. Fields for payment cards, card security codes, passwords, bank accounts, Social Security numbers, passports and driver’s licenses are never sent to Jev at all. Stash’s server passes the request to Jev and does not store or log the form description or Jev’s answer. To prevent abuse, it keeps a short-lived count of requests per app installation and network (IP) address.
Your approval. Each time, the Stash app asks you to choose which saved profile to fill with, and nothing is filled until you choose one. If Smart Paste wants to tick or untick checkboxes, the Stash app lists those changes for a separate approval. Smart Paste then places only answers from the profile you chose into the form on your screen. It never submits the form. Undo puts back the fields it changed and keeps any edits you made afterwards.
Where your answers are stored. Your saved answers are kept encrypted in the Stash app on your Mac. They are not stored by the extension and are not sent to us.
Payment cards. If you use a saved card, the card details go from the Stash app straight into the secure card fields of the payment provider on that page: Stripe, Braintree, Adyen, Shopify, Square, Checkout.com, Recurly, Spreedly, Mollie, Chargebee or Worldpay. Stash asks your permission for each provider the first time it is needed. The extension does not store card numbers or send them anywhere else.
What the extension keeps. To support Undo, the extension keeps a note of which card frames it filled, in browser session storage, which clears when Chrome closes. For Report this form, it also keeps a description of your last Smart Paste attempt on each tab there (the field structure and outcomes described below), for at most 30 minutes, cleared when you close the tab or leave the page. Neither holds field values.
Report this form. If Smart Paste misses or mis-fills a form, you can click Report this form in the Stash toolbar popup. Nothing is sent unless you click it. A report goes to Stash’s server and contains:
A report never contains your saved answers, anything typed into the page, a field’s value, the text of field labels (each label is replaced with “[omitted]”), drop-down choices, or which profile you used. Reports are stored on Stash’s server, readable only by Stash, and used only to make Smart Paste work on more forms. To prevent abuse, the server keeps a short-lived count of reports per installation and network (IP) address.
The attestation server may query crt.sh (a public Certificate Transparency log) for TLS certificate fingerprints associated with the captured page's domain. This is a public certificate lookup.
Smart Paste (Beta) uses Jev, an AI service operated by TypeSafe, through Stash’s server, as described above.
The extension does not sell, share, or transfer user data to any third party for advertising, marketing, or any purpose unrelated to the extension's core functionality (screenshot capture, attestation and Smart Paste).
If this policy is updated, the changes will be reflected here with an updated date. Significant changes will be noted in the extension's changelog.
For questions about this privacy policy or the extension's data practices, contact chris@yourstash.ai.