最終更新日：2026年10月5日
Private Stash プライバシーポリシー
このプライバシーポリシーは英語版のみです。
Private Stash is a browser extension for Chrome, Edge and Firefox that keeps encrypted notes and private links in a password-locked side panel. It is not a password manager.
What we collect
Nothing. Private Stash has no analytics, no crash reporting, no remote configuration and no accounts. The developer runs no servers that receive your data.
Where your data lives
- On your device. Notes, links, folders, tags and settings are encrypted with a key derived from your master password (Argon2id + AES-256-GCM) and stored in the browser’s extension storage. Your notes and links are only ever written to disk encrypted.
- A few values that aren’t secret are kept unencrypted, so the extension can work while it’s locked: the theme, accent color and density, the interface language, the license status, the count of wrong password attempts and the sync status.
- While your stash is unlocked, its key is kept in the browser’s session storage, which lives in memory and is cleared when the browser closes.
- Browser sync (optional, Pro). If you turn on sync, the same encrypted data is copied to your browser’s own sync storage, under the account you’re signed in to the browser with (for example your Google account, or your Mozilla account on Firefox). The browser vendor sees encrypted data only, plus metadata such as record count, sizes and timestamps.
- Backups. Exported backup files contain only encrypted data and are saved wherever you choose.
Your master password and decryption key never leave your device. There is no password recovery.
Network requests
The current version of Private Stash makes no network requests. Pro can’t be bought yet, so the Upgrade and Restore purchase screens are switched off.
As the extension is built, once Pro can be bought, its only network requests are Solana JSON-RPC calls to a public Solana endpoint (currently api.mainnet-beta.solana.com), made only while you are on the Upgrade or Restore purchase screens, to detect and verify your USDC payment. These requests reveal your IP address and the payment reference (or the transaction signature you paste to restore a purchase) to the RPC provider. They never contain your notes or links.
Favicons for saved links come from the browser’s local cache (Chrome and Edge) or are drawn locally (Firefox), so the extension never contacts the linked sites. Images in notes are never loaded.
The pages you visit
Private Stash has no content scripts and no access to websites, so it never reads or changes the pages you visit. It sees a page’s address and title only when you save it: with “Save current tab”, or with “Save page” or “Save link” in the right-click menu.
Permissions
| Permission | Why |
|---|---|
storage, unlimitedStorage | Your encrypted stash, the session key while it’s unlocked, and optional sync |
sidePanel (Chrome and Edge) | The main interface. Firefox shows it as a sidebar, which needs no permission |
alarms | The auto-lock timer and the Pro renewal reminder |
idle | The optional “Also lock when my computer locks or sleeps” |
favicon (Chrome and Edge) | Show saved links’ icons from the browser’s local cache |
contextMenus | “Save page to Private Stash” and “Save link to Private Stash” in the right-click menu |
activeTab | Lets that right-click read the page title, only for the tab you clicked in |
tabs (optional) | Asked for the first time you click “Save current tab”, to read the active tab’s address and title. You can decline and add links by hand |
Clipboard
Private Stash writes to your clipboard only when you copy something, such as a link’s address. By default it tries to clear the clipboard 30 seconds later. You can turn this off in Settings, under Privacy.
Deleting your data
Delete notes and links in the panel. To erase the whole stash, click “Forgot password?” on the unlock screen and choose “Reset & delete vault”, which can also delete the copy in browser sync. In Settings, under Sync, “Remove data from browser sync” deletes the synced copy on all your devices. Removing the extension deletes everything it stored on that device.
Payments
Pro isn’t on sale yet. As built, it is paid in USDC on Solana: payments are public blockchain transactions made from your own wallet, and Private Stash never sees your wallet keys. License checks run in the extension.