Privacy Policy

Information We Handle

Authentication accounts

We process the secret keys you enter, import or scan, along with account labels, service names and the settings needed to generate codes: authentication type, algorithm, digits, period and counter. Imported accounts may include icons, setup URLs and groups.

Account and service information

Sign-in and membership features use your email, service account information and membership expiration. The extension also handles your preferences, saved cloud-sync password, temporary sign-in state and icon cache. Support messages are used to respond to your inquiry.

Website information

The active tab's address is read to match accounts to the current site. When you request a QR scan, page images and canvases are decoded in your browser. Code filling inspects suitable input fields on that page.

How Information Is Used

• Generate authentication codes in your browser and manage your saved accounts.
• Scan setup QR codes, match accounts to websites, and copy or fill codes when you click them. Automatic filling is enabled by default and can be turned off; the receiving website can access a filled code.
• Synchronize accounts when you use sync features, manage sign-in and membership, process payments, and handle support or deletion requests.

Storage and Cloud Sync

Browser storage: Authentication accounts, including secret keys, and preferences are saved in Chrome's sync storage. Chrome may synchronize them across your signed-in browsers according to your settings. Service sign-in information, membership details, the saved cloud-sync password and icon cache use local extension storage.

ShipLang cloud sync: This is separate from Chrome sync. After you sign in and save a sync password, the extension sends your email, application identifier, sync password, interface language and authentication accounts to shiplang.com. Uploaded accounts include the actual secret keys, labels, service names, authentication type and algorithm.

A sync can upload existing browser accounts and download cloud accounts. Once sign-in information and a sync password are saved, adding or editing accounts can also upload changes.

Connected Services

Sign-in and payment open crx.shiplang.com, passing the application and extension identifiers, version, interface language and, when available, your email and membership expiration. Returned account and membership information is saved locally.

• weidali ltd / ShipLang receives the cloud, account, membership and payment records needed to operate these services.
• Google provides sign-in and, separately, Chrome synchronization when enabled. See Google's privacy policy.
• PayPro and Stripe process billing, transaction and payment information during checkout. See the PayPro policy and Stripe policy.
• Email services deliver your support and deletion messages. GitHub hosts this policy page under its privacy statement. This page contains no analytics scripts, forms or external fonts.

Browser Permissions

• Storage: Saves accounts, preferences and service state.
• Tabs: Reads the active tab's address and communicates with the page.
• Website access: Supports page QR scanning, code filling and cloud requests. You can manage permitted sites in Chrome's extension settings.

Keeping and Deleting Data

weidali ltd retains cloud authentication data, account records, payment records and service logs long term until you request deletion. Email e@ShipLang.com to make a request. Requests are processed within seven days of receipt. weidali ltd does not maintain backups of this service data.

Deleting an account removes its browser sync record. When sign-in information and a sync password are available, it also requests that the cloud record be marked as deleted. Local deletion alone does not confirm permanent cloud deletion.

Clear All Data clears browser sync storage, the icon cache and the saved sync password. It does not clear ShipLang cloud records, locally saved service sign-in information or previously exported files.

Google, PayPro, Stripe and GitHub follow their own retention and deletion policies. A request to weidali ltd does not itself erase records held independently by these providers.

Security and Your Choices

Cloud requests use HTTPS, but secret keys and the sync password are sent in request URL parameters without an additional client-side encryption layer. The saved sync password is also held in local extension storage.

Exported text backups contain readable authentication secrets. Protect or delete them using your device's file controls. Local diagnostic console messages during code filling may include codes and input-field information.

You can edit or delete accounts, export your data, turn off automatic filling and site filtering, manage Chrome synchronization and site access, or choose not to enable ShipLang cloud sync.

Policy Updates

We will revise this page when our data practices change and update the date above.