Privacy Policy

Effective Date: June 2026

1. Client-Side Processing

All cryptographic computations, including data encryption, decryption, key derivation, and hashing, are performed entirely within your local browser environment using locally bundled JavaScript libraries. The browser-native Web Crypto API is used exclusively for cryptographically secure random number generation.

• No External Server Transmission: Encrypt Chief is designed so that sensitive text inputs, passwords, passphrases, and generated keys are processed locally on your device and are not transmitted to any server.
• Permanent Offline Functionality: Because the application does not depend on a server-side architecture to function, once the app has downloaded its assets on your device, Encrypt Chief can be used completely offline indefinitely. You can safely disconnect your internet connection entirely while using the application to operate in an isolated offline environment.

2. Browser Storage And Minimal Analytics

To provide a robust offline experience and maintain the app, the application utilizes sandboxed browser storage technologies (such as localStorage, sessionStorage, and Cache Storage via Service Workers). Encrypt Chief does not intentionally store plaintext, encrypted content, passwords, passphrases, or cryptographic keys in browser storage unless explicitly required by a feature that the user activates.

• Core Utility And Preferences: Local storage is used to cache core application assets (HTML, CSS, JavaScript) ensuring instant loading offline, and to remember local, non-sensitive UI configurations or preferences you explicitly set. This data never leaves your device.
• In-House Usage Metrics: When the application homepage is launched, a lightweight, custom, privacy-respecting script executes to record a single usage event. The event records only whether the application was launched from a standard browser tab or as an installed PWA. No user content, passwords, cryptographic material, cookies, or unique identifiers are included in the request.
• How Metrics Are Processed: To protect your identity, we do not bundle any third-party tracking scripts (like Google Analytics). Instead, the application sends a lightweight request to our web server to generate a basic access-log entry. If you are entirely offline when opening the app, this non-sensitive event string is safely queued inside your local localStorage cache and sequentially flushed only when your device reconnects to the network or the application window becomes active. This metric does not contain tracking tokens, personal details, or behavioral tracking data.

3. No Third-Party Trackers

To eliminate surface areas for metadata leaks or third-party surveillance, Encrypt Chief operates under a strict proprietary framework:

• No Cloud Intermediaries: There are no backend database synchronizations or server-side relays handling your operations.
• No Third-Party Trackers: We do not embed web beacons, tracking pixels, or third-party marketing frameworks. Your user behavior, session durations, and interaction metrics are completely invisible to third parties.
• No Advertising Networks: The application contains zero commercial advertising integrations, avoiding the data profiling and behavioral cross-tracking inherent to modern ad networks.

4. Source Code Transparency And Peer Review

Privacy claims are most meaningful when they can be independently verified. Because the application processes everything locally within the web browser, its entire operational execution layer consists of plain client-side code. The nature of this architecture allows advanced users, developers, and security auditors to inspect the network tab, inspect localized scripts, or perform a full peer review of the client-side code directly through standard browser developer tools. This transparency allows technically inclined users to inspect application behavior and independently evaluate our privacy claims.

5. Security Boundaries

Encrypt Chief cannot protect against malware, viruses, unauthorized access to your device, compromised browser environments, or other security issues unrelated to the application’s cryptographic functionality. Users remain responsible for maintaining the security of their devices and credentials.

6. Standard Web Hosting Logs

When you access the application online to download or update the PWA assets (or when the in-house app-open metric initializes), the underlying web server infrastructure hosting the static files registers standard, low-level technical metadata (such as your IP address, browser type, and timestamps) inside standard server access logs. This is a baseline requirement for serving static files over HTTPS, analyzing overall launch traffic metrics, preventing denial-of-service (DoS) attacks, and ensuring network stability. This network metadata is never linked to your local encryption activities. Server logs are retained for 30 days and then automatically deleted.

7. Changes to This Policy

As a privacy-centric utility, the fundamental principle of local-only processing will never change. If minor functional updates require modifications to how local preferences are cached, this document will be updated explicitly with a revised effective date. Your continued use of the application after updates constitutes an acknowledgment of the current terms.

8. Contact

Questions regarding this Privacy Policy may be directed to: js-replaces-this-placeholder