RosterMask Privacy Policy

Effective: October 20, 2026. Applies to the RosterMask browser extension (beta). Live copy: https://rostermask.pages.dev/privacy

Summary: RosterMask processes your data only on your device. We do not collect, receive, store, sell or share it.

What the extension processes, on your device only

• Text and files you choose to tokenize or restore.
• Your client list (names and nicknames you import).
• Token keys. Each export's token key is kept in your browser's local extension storage, encrypted with AES-256-GCM using a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations). Keys auto-delete after the period you set.
• The audit log: counts and types of items replaced, never the values.

What we receive

Nothing. The extension makes no network requests. There is no analytics, no crash reporting, no advertising and no account. We can't see your data or your passphrase, and we can't recover a forgotten passphrase.

AI websites

On grok.com, chatgpt.com, claude.ai and gemini.google.com, the extension replaces identifiers in text you paste, or in the message box when you click its button. What you then send to those services is governed by their own terms and privacy policies.

Sale and use of data

We do not sell user data, transfer it to third parties, use it for purposes unrelated to the extension's single purpose, or use it to determine creditworthiness or for lending.

Deleting your data

• Delete one export: use Exports.
• Delete your client list and every token key: use Destroy vault.
• Remove everything: uninstalling the extension removes all of its stored data.

Children

RosterMask is a business tool and is not directed to children under 13.

Changes

We will post updates on this page and change the effective date.

Contact

Use the Support tab on the RosterMask Chrome Web Store listing.

This policy describes how the extension handles data. It is not legal or compliance advice about your own obligations.