Gnomad Slate

Privacy Policy

Last updated: June 2026 · Developer: Gnomad Studio (gnomadstudio.org)

At Gnomad Studio, we build local-first tools. This Privacy Policy explains how the Gnomad Slate browser extension processes your data.

1. Our Core Privacy Philosophy

Gnomad Slate is built to be secure, private, and local-first:

  • We do not run any database servers, authentication portals, or sync servers.
  • We do not collect, read, transmit, or sell any of your notes or passwords.
  • No analytics trackers or telemetry scripts are bundled in the extension.

2. Data We Process and Where It Lives

All information you input into Gnomad Slate remains in secure browser sandboxes or your own personal cloud accounts:

  • Markdown Notes & Scratchpad: Notes are saved locally in the browser's private local storage partition (chrome.storage.local). They are never sent to Gnomad Studio.
  • Vault-X Secrets (API Keys, Tokens): Secrets are encrypted client-side using AES-256-GCM with a key derived from your master password using PBKDF2-HMAC-SHA256. The decrypted secrets exist only in the temporary background memory of the extension service worker while the vault is unlocked.
  • Master Password: Your master password is never stored in plaintext. It is verified using a cryptographic salt and hash stored in your browser's local storage.
  • Clipboard History: The Clipboard History Capsule saves text entries in-memory only (chrome.storage.session). It is cleared automatically when you close the browser. If the clipboard filter is active, it runs locally in JavaScript and does not transmit data.

3. Optional Cross-Device Synchronization

If you choose to enable synchronization, data is moved via third-party channels that you control:

  • Chrome Profile Sync: Syncs settings and small vaults using Google's native chrome.storage.sync profile sync. This is governed by your Google Account privacy settings.
  • Google Drive AppData Sync: Syncs notes and secrets to a hidden, private application folder on your personal Google Drive (appDataFolder).
    • Zero-Knowledge Encryption: If sync is enabled, notes are encrypted client-side using your derived vault key before leaving your browser. Gnomad Studio and Google have zero access to the contents of your synced notes or vault.

4. Third-Party Permissions Declared

The extension requests the following permissions from your browser:

  • storage: Required to save your notes, configuration, and encrypted vault locally.
  • sidePanel: Required to display the Gnomad Slate scratchpad in your browser's side panel.
  • identity: Required to request authorization to sync files to your own Google Drive.
  • clipboardRead & clipboardWrite: Required to allow you to quickly copy passwords to your clipboard and populate the in-memory clipboard history modal.
  • notifications: Required to notify you when sync operations succeed or fail.

5. Changes to This Policy

As a local-first extension, we will never change the core behavior of Gnomad Slate to collect user data. If we introduce new features (such as integrations with other cloud providers), they will remain opt-in and client-side encrypted.

6. Contact Us

If you have any questions about this privacy policy, please contact us at: