SafeCookie

Privacy Policy

Effective November 9, 2026

In short: your sessions, passwords and 2FA keys stay in an encrypted database on your computer. We never receive them. The few things we do receive are anonymous usage numbers, listed below.

1. Who we are

SafeCookie is an independent project by Omar Abdelmohsen (“we”, “us”). This policy covers the SafeCookie Windows app, the SafeCookie Bridge browser extension and the websites at safecookie.app, docs.safecookie.app and themes.safecookie.app. Contact: omar@safecookie.app.

2. What stays on your device

Saved sessions (cookies), passwords, 2FA keys, PIN settings and app settings are stored in an encrypted local database on your computer. The encryption key is derived from your computer's identifiers each time the app starts and is not saved to disk. Passwords and 2FA keys get an extra layer of encryption. We do not upload, receive or have access to this data. Backups you export are protected by the password you choose and saved where you choose.

3. What we collect

  • Website visits and downloads. When you open the website or click Download, we record the event type, the page path, the date and time, and a one-way hash of your IP address. The hash is used to count unique visitors and cannot be turned back into your IP address.
  • App usage heartbeat. While the app is running it sends a small signal about every 10 minutes containing a random installation ID, a random session ID, the app version and a timestamp. We use it to count active installations and versions. It is not linked to your name, email, hardware ID or location, and we do not store raw IP addresses in these statistics.
  • Blocked-request counter. The app reports how many ads and trackers it blocked as a single number. It contains no domains, no websites and no IDs. To limit abuse, a short-lived hashed form of the sender's IP address is kept briefly and deleted automatically.
  • Updates and blocklist. The app checks for new versions and downloads our blocklist from our servers using ordinary HTTPS requests.
  • Server logs. Our hosting provider may keep standard server logs (IP address, time, requested address and browser or app identifier) for security and troubleshooting.

4. What we do not collect

We do not collect your name, email, passwords, cookies, session contents, 2FA keys, PINs, browsing history, the websites you visit, which domains were blocked, or your tracker activity. The Tracker activity list in the app is kept in memory only and is cleared when you close the app.

5. Browser extension

The SafeCookie Bridge extension asks for these permissions so its features work:

  • Cookies: to save and restore the sessions you choose to manage.
  • Tabs and scripting: to notice when you open a website with a saved session and show the login popup on the page.
  • Web request and declarative net request: to detect and block trackers and ads.
  • Access to all websites: so those features work on any site you use.
  • Storage and alarms: to keep settings and run background tasks.

The extension talks only to the SafeCookie app on your own computer. It does not send your browsing data to us.

6. Third parties

The website loads fonts from Google Fonts, so Google receives your IP address when a page loads. Our websites are served by a hosting provider. We do not show ads, do not sell or share your data, and do not use third-party analytics services.

7. How long we keep data

We keep visit, download and heartbeat records for as long as we need them for statistics. To have the records tied to your installation deleted, email us the ID found in the file named USER-ID in SafeCookie's data folder. Data on your device stays until you delete it (for example with Delete All Sign-ins, by removing items, or by deleting the app's data folder).

8. Security

We use reasonable measures to protect the little data we hold, and the app encrypts your local data. No system is perfectly secure, and you are responsible for keeping your computer, PIN and backups safe.

9. Your rights

Depending on where you live, you may have the right to access, correct or delete personal data we hold about you. Because we hold very little that identifies you, the easiest way to use these rights is to email us.

10. Children

SafeCookie is not directed at children under 13, and we do not knowingly collect their data.

11. Changes

We may update this policy. The effective date above shows when it last changed, and continued use after an update means you accept it.

12. Contact

Questions? Write to omar@safecookie.app. See also our Terms of Use.