SafeAssist Filler extension privacy

Who we are

SafeAssist is a product of Howlin Wolf Applications. Questions about this policy: use the contact options on callvault.dev.

What the extension does

When you choose to fill a login, the extension types a username and password into the active https page. It does not autofill when a page loads. The fill helper is injected only after you click the extension or a fill control you asked for on the current https tab. A password is typed only after you pick a saved login whose site exactly matches that tab.

What stays on your device

• Extension session token: After you sign in, a short-lived SafeAssist token is kept in chrome.storage.session (browser memory for the session). It expires automatically.
• Optional settings: If you change API or Auth0 values on the extension settings page, those fields are stored in chrome.storage.sync so they follow your Chrome profile.
• Passwords: The extension does not save passwords to disk storage. A password is fetched only for the fill you requested and is used to type into the page.

What we send to our servers

• Sign-in: Your Auth0 access token is sent to https://api.callvault.dev/v1/extension/session to receive a SafeAssist extension session. Auth0 sign-in itself goes to our Auth0 tenant (dev-5v8feahbbounv25n.us.auth0.com).
• Match list: When you open the extension on a tab, we send the page origin (for example https://example.com) to GET /v1/extension/filler/matches so you can pick a saved login.
• Fill: When you choose a login, we send the login id and origin to POST /v1/extension/filler/fill and return the username and password once for that action.

What we do not do

• Run fills without your click.
• Load a fill helper on every website when pages load.
• Read usernames or passwords from pages you did not ask to fill.
• Sell your personal data.

Updates

We may update this page when the extension changes. The version in the Chrome Web Store listing links here.

Last updated: October 5, 2026