Autograph Privacy Policy

Key storage

Keys generated in or imported into autograph are stored in the extension's local browser storage, encrypted at rest with a passphrase you choose. They are never transmitted anywhere, not to buildtall.systems and not to any third party.

Data collection

Autograph collects no data. There are no analytics, no telemetry, and no crash reporting. Installs from the self-hosted Firefox channel check this site's update feed for new versions; that check is a standard HTTP request and carries no identifying information. Store installs update through their stores instead.

Permissions

• storage: holds the encrypted key vault and your per-origin permission grants.
• clipboardWrite: copies your public key (npub) when you ask for it.
• Access to web pages: injects the window.nostr provider so sites can request signatures. Every request is shown to you and requires your approval; grants are scoped per origin and expire.

Signing

Events are signed inside the extension. The requesting site receives the signature, never the private key.

Contact

Questions and reports: GitHub issues.