RoleTap Privacy Policy

Data RoleTap accesses

On an app tab you connect, RoleTap accesses the tab’s URL and origin, cookies (including HttpOnly cookies and their security, path, expiry, and partition attributes), and top-frame localStorage and sessionStorage. These values may contain authentication tokens, user identifiers, personal information, or other application data. Profile names, colors, workspace names, host patterns, selected key names, and capture timestamps are also stored.

An explicit Capture or Recapture action reads available session entries into extension memory for you to select. Only selected values are saved in the profile. Once the vault is unlocked and the necessary site access is granted, RoleTap may automatically compare managed values when you open or refocus its popup and after switching. Comparisons and switching read managed web-storage keys and query managed cookie names; unrelated web-storage values are not read for those checks. Cookie reads are constrained to the target site’s domain family and filtered to cookies applicable to the target hostname, including non-root paths.

How the data is used

RoleTap uses this information only to capture, edit, compare, inspect, export, import, and restore the test sessions you choose. JWT inspection decodes claims locally; it does not verify token signatures. RoleTap does not collect browsing history for analytics, advertising, profiling, credit decisions, or resale.

Switching writes the selected profile’s managed cookies and storage values, removes managed values absent from that profile, and normally reloads the chosen tab. Cookies and local storage may affect other tabs sharing their browser scope. Session storage changes affect the selected tab. Your app may send applied credentials to its own servers through its normal operation; its privacy policy and connection security apply, including when you choose an HTTP development site.

Local storage and encryption

Saved profiles and workspace configuration are encrypted in chrome.storage.local using AES-256-GCM. A key is derived from your vault passphrase using PBKDF2-SHA256 with 600,000 iterations and a random salt. Each encrypted write uses a fresh random initialization vector. The passphrase and encryption key are not saved to persistent local storage or sent to the publisher. When setting up a vault over an older unencrypted installation, existing profiles are encrypted in place after you agree and submit your vault passphrase. Previously downloaded files or backups are not converted.

While the vault is unlocked, its key is kept in Chrome’s memory-backed chrome.storage.session so background work can survive service-worker restarts. There is no inactivity auto-lock: the vault stays unlocked until you lock it manually, reset or delete it, or Chrome clears session storage. Browser restart, extension reload, update, or disable clears session storage and requires unlocking again. Decrypted values are present in extension memory while in use.

Consent version and acceptance time, vault identifier, and format version are stored locally without session values. Temporary recovery journals are encrypted in session storage. A brief operation status may contain the selected profile’s name and is cleared on locking. Chrome restricts RoleTap’s storage to trusted extension contexts. Encryption protects RoleTap’s saved copies; it does not encrypt the app’s own cookies or web storage, protect an unlocked browser from someone using your device, or provide passphrase recovery.

Sharing and exported files

RoleTap has no publisher-operated extension backend, telemetry, analytics, advertising, account system, or automatic cloud sync. It does not upload session data to the publisher or sell it. Apart from the user-directed application use and exports described in this policy, it does not transfer session data to third parties. Workspace icons use Chrome’s favicon facility rather than a publisher-operated icon service.

Export is an action you initiate. Exports contain a profile’s credentials and environment configuration, encrypted with a separate passphrase you choose. Anyone with the file and passphrase may be able to use those credentials. Share only with people you trust and send the passphrase separately. RoleTap cannot revoke copies you have exported or shared.

Legacy unencrypted RoleTap JSON files can be imported after a preview. Imported values are encrypted when saved in the vault, but the original file remains unchanged on your device. An import never automatically applies the session.

Optional support through Buy Me a Coffee

Support RoleTap opens https://buymeacoffee.com/anryverse in a separate tab. Support is voluntary and does not unlock or restrict extension features. The link includes no session values, tracking parameters, or referrer, and no payment widget or SDK runs in the extension.

Buy Me a Coffee and its payment provider, Stripe, handle payment information under their own privacy policies. The publisher may receive your supporter name, email address, message, support amount, and date through Buy Me a Coffee. This information is separate from the local vault and is used to acknowledge support and handle questions about the transaction. RoleTap does not receive card details, payment confirmations, or donor status. Contact the publisher about supporter information they receive; Buy Me a Coffee and Stripe manage records retained by their own services.

Permissions and your choices

RoleTap requires an unchecked-by-default privacy agreement on the vault passphrase form before accessing sessions. Consent is recorded when you create the vault. If the consent version changes, the agreement is required again on the unlock form before saved sessions can be accessed. You may leave the agreement unchecked to decline access. Chrome site access is requested through explicit Capture, Recapture, Switch, or recovery actions. Required permissions support local storage, cookie handling, access to the selected app tab, on-demand isolated-world scripts, and workspace favicons. Optional HTTP/HTTPS access is declared so you can choose your own sites; runtime requests are limited to the destination host and necessary parent hosts for domain cookies. Chrome host grants may cover additional ports or subdomains under its permission rules.

Use Privacy → Withdraw session access in the popup or manager to withdraw consent. A confirmation dialog requires you to type WITHDRAW before deleting the vault, all saved profiles, workspaces, recovery data, and the consent record, and removing optional site grants. Your app sessions and downloaded exports remain unchanged. Canceling leaves saved data in place. You can also revoke a site’s access in Chrome’s extension settings. After withdrawal, a new vault requires a new privacy agreement.

Retention, deletion, and recovery

Saved profiles remain until you delete them, delete their workspace, reset the vault, confirm withdrawal, clear the extension’s data, or uninstall RoleTap. Deleting a workspace removes its saved profiles and managed-key configuration. Deleting a profile does not sign you out of an app or remove already applied cookies and storage. Workspace managed-key names can remain until the workspace is deleted.

Recovery journals remain in memory-backed session storage until successful switching or recovery, explicit dismissal, or Chrome clears that storage. They can survive service-worker restarts, but not browser restarts. Unresolved recovery information remains encrypted while the vault is locked. Downloaded files, teammates’ copies, browser backups, and an app’s own session data have separate lifetimes and must be removed separately.

The publisher cannot access, retrieve, reset, or delete a local vault remotely. If you lose your passphrase, choose Reset vault on the unlock screen. Type RESET and confirm to delete all saved profiles, workspace configuration, and recovery data on this device, remove optional site grants, and create a new vault. Reset retains the previous consent record, while creating the replacement vault still requires checking the privacy agreement. Unlike withdrawal, reset does not revoke consent. It does not recover the old passphrase, change your app sessions, or delete exported files. Previously exported profiles can be imported with their own file passphrases. You can also uninstall RoleTap to remove saved extension data.

Chrome Web Store Limited Use

RoleTap’s use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Session data is used only for the prominently described, user-facing session-management features. It is not used for advertisements, sold to data brokers, or transferred for unrelated purposes.

Policy updates and contact

This policy will be updated when RoleTap’s data practices change. Material changes to session-data handling require an updated in-product consent version. The date above identifies the current policy. Visiting this policy on the publisher’s website may produce ordinary web-hosting access logs; the extension does not send credentials with a policy-page visit.

Publisher: Jojhel Anry Laureste Carrascal. For privacy questions or support, email anry.it.dev@gmail.com. Please do not include passwords, tokens, authentication cookies, or exported session files in support messages.