AsyVault Privacy Policy

Effective date: October 15, 2026
Publisher: ASYGAMES
Product: AsyVault browser extension, version 0.6.1
Contact: admin@burnet.win

1. Local vault storage

AsyVault is a local-first password manager. You can use its local vault without creating an AsyVault account or connecting to GitHub.

The vault may contain information you choose to save, including usernames, passwords, website addresses, secure notes, identity details, payment-card details, API credentials and SSH keys.

Vault contents are encrypted locally using AES-256-GCM with keys derived from your master password. Your master password is not transmitted to GitHub or to an ASYGAMES-operated server.

Local preferences, permission choices and operational metadata, such as synchronization status, are stored separately from encrypted vault contents. While the vault is unlocked, the extension processes decrypted information and temporary cryptographic material in extension-controlled contexts to provide its features.

1. Optional website integration

With your permission, AsyVault can access relevant forms and fields on authorized HTTPS websites to recognize logins, offer suggestions, capture credentials for saving and fill supported fields.

Site access can be granted for individual sites or more broadly through the extension's optional website permissions. You can revoke site access through Firefox's extension permission controls.

When you use a filling feature, the selected information is placed into the website's fields and becomes accessible to that website. The website may process or transmit it under its own policies. Only fill sensitive information on websites you trust.

1. Optional GitHub backup and synchronization

GitHub connection is optional. If you connect your account, AsyVault uses GitHub OAuth Device Flow and requests the repo scope. This scope grants broader repository access than access to the backup repository alone; GitHub does not restrict that OAuth permission exclusively to asyvault-data.

AsyVault's backup functionality uses a private repository named asyvault-data in your GitHub account. It transfers encrypted vault snapshots, rather than plaintext vault entries.

GitHub receives the encrypted snapshots and the information necessary to handle the requests, including account information, repository paths, commit metadata, IP addresses and routine network request metadata.

The OAuth access token is stored encrypted locally and is sent to GitHub over HTTPS for authorized requests. AsyVault does not send your vault contents or GitHub OAuth token to an ASYGAMES-operated server.

After GitHub authorization and connection setup, automatic synchronization is enabled by default unless you previously disabled it in that browser profile. Synchronization can run after local changes and in the background while the vault remains unlocked. You can disable automatic synchronization or disconnect GitHub in the extension.

A request already in progress may finish after synchronization is disabled or GitHub is disconnected.

GitHub handles information under its own privacy policies:
https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

1. Firefox data-transmission permissions

GitHub vault backup and recovery require your approval of the optional Firefox data-transmission permissions. These cover the categories of information that the encrypted vault and GitHub authorization can involve.

Declining these permissions does not prevent local vault use. Revoking them blocks subsequent GitHub vault synchronization and authorization requests, but does not remove information already transferred.

In this release, GitHub vault backup and recovery are unavailable on Firefox versions that do not support the required built-in data-permission mechanism.

1. Update checks and other network activity

Firefox manages official extension updates through its normal update mechanism.

An on-demand public release check may contact GitHub to retrieve release information. This request does not upload vault contents, but GitHub receives routine request metadata.

This release does not use advertising trackers or analytics telemetry. The Firefox version uses bundled fallback icons rather than sending saved website addresses to an external favicon service.

1. Retention, deletion and backups

Local encrypted vault information remains in browser extension storage until you remove it or clear the extension's data. Deleting an entry from the current vault does not guarantee removal from earlier encrypted snapshots, synchronization records or exported backups.

Encrypted GitHub backups and repository history remain in your GitHub account until you manage or remove them there. Disconnecting GitHub removes the locally stored authorization, but does not delete the remote repository or revoke the authorization on GitHub.

You can revoke OAuth access through your GitHub account's application settings. Exported .asyvault files remain wherever you saved them and must be managed separately.

1. Use of information and support

AsyVault uses information to provide vault storage, website integration, encrypted backup and the other features described above. We do not sell vault information or use it for advertising.

If you contact support, your message contains the information you choose to send and is used to address your request. Do not include master passwords, OAuth tokens, recovery codes or unencrypted vault contents in support messages.

1. Security and policy changes

AsyVault is an early-stage project and has not undergone an independent security audit. Encryption does not eliminate every security risk. Keep separate encrypted backups and do not use AsyVault as your only storage location for critical recovery information.

We will update this policy when the extension's data practices materially change.

For privacy questions, contact admin@burnet.win.