Extension data
Routines, scheduled addresses, preferences and activity stay in the extension's local IndexedDB storage in your Chrome profile. Exported backup files are unencrypted JSON; store and share them carefully. We do not ask for your Chrome password or access to destination-page contents.
License service
The production client is configured for HTTPS at licenses.fromartur.com. The issuer is designed to run as a non-root, read-only container behind a dedicated Caddy route, with no host port. It stores a one-way SHA-256 hash of each redemption key. License receipts and revocation proofs are signed with Ed25519 so the extension can verify them without receiving the private signing key.
The deployment configuration mounts the database in restricted service storage and mounts signing keys read-only; public client builds contain only public verification keys and the service address. The service limits request rates, caps request bodies at 8 KiB, rejects unsupported browser origins and returns generic internal errors. Administrative routes require a separate bearer token. Fastify request logging and Caddy access logging are disabled for the reviewed license route; request bodies, license keys, receipts and authorization headers are not intentionally logged.
Current release gate
Production paid-sales and paid-issuance feature flags are disabled. The public service may expose health and catalog checks and support existing-license operations, but new Pro applications and paid key issuance must remain unavailable until the exact Chrome Web Store extension ID allowlist, public TLS route and end-to-end license checks are verified. No customer, payment or grant records existed in the database at the 26 October 2026 audit.
Backups and recovery
A system timer runs the SQLite online-backup tool once each day. The first production snapshot completed successfully, local snapshots use service-account-restricted storage on the VPS and expire after 30 days. A full database snapshot can contain customer email, order and payment references, hashed keys, license and installation identifiers and audit entries. Signing keys are backed up separately. Restore testing begins in an isolated staging path. An external backup destination, exact data-centre location and backup-at-rest encryption have not been confirmed.
Updates and incidents
We review dependencies and deploy fixes when a security issue affects the extension or issuer. If we discover a security incident involving personal information, we will assess its impact and notify affected people and authorities where required. We cannot guarantee that any software or network is free of all risks.
Report a vulnerability
Send a concise report to artur@fromartur.com with the affected component, steps to reproduce and a safe contact method. Do not include other customers' personal data, exploit the issue beyond what is needed to demonstrate it, or publish a working exploit before we have had a reasonable chance to investigate. We will acknowledge actionable reports and coordinate a fix and disclosure with you.