Privacy Policy

Sam Soft Privacy Shield · Operated by Sam Software LLC · Effective date: 18 August 2026

This Privacy Policy explains how the Sam Soft Privacy Shield browser extension (the “Extension”), operated by Sam Software LLC (United States) and Sam Software Ltd (Uganda) (together, “we,” “us,” “Sam Software”), collects, uses, stores, shares, and protects information. The Extension is designed to keep the vast majority of your data on your own device. This policy covers every case where data is collected or transmitted, and describes what we never collect.

1. Information we collect

We collect only the limited data below, and only for the purposes described in Section 2. We do not collect your browsing history, and we do not use analytics or advertising trackers.

Data	When it is collected	Source
Email address	When you set up the Extension (required), and when you run an email breach check (Pro)	Provided by you
Domain names of sites you visit	When the phishing/malware protection feature is enabled (on by default), the domain only of a page you navigate to is checked — never the full URL, query string, or page content	Your browser
Partial, irreversible password hash	When you run a password breach check — only the first characters of a one-way SHA-1 hash (k-anonymity)	Your saved passwords, hashed on your device
License key & a device/session identifier	When you activate a Pro license	Provided by you / generated locally
Optional uninstall feedback	Only if you choose to submit the uninstall form	Provided by you
Payment information	When you purchase Pro (processed by our payment provider; we do not receive or store card numbers)	Provided by you to the payment provider

We do not collect: your browsing history, the content of the pages you visit, your full URLs, your actual passwords, your name (unless you provide it), device fingerprints, location data, or any advertising/analytics identifiers.

2. How we use your information (handling)

Email address — to send you security/breach alerts and important product updates, to check your email against known-breach databases when you request it, and to link your Pro license to you for renewal reminders. We do not use it for advertising.
Domain names — solely to check whether a site you are about to open is a known phishing or malware site, and to warn you. The check is performed and discarded; results are cached only to reduce repeat lookups.
Partial password hash — solely to tell you whether a password appears in a known breach. Your full password is never sent and cannot be reconstructed from what is sent.
License key & device identifier — solely to activate Pro, enforce one-license-per-user, and manage subscription expiry.
Uninstall feedback — solely to improve the product.
Payment information — solely to process your purchase through our payment provider.

3. How we store and protect your information (storage & security)

Stored locally on your device (never sent to us)

Your password vault, encrypted with AES-256-GCM using a key derived from your master password (PBKDF2, 600,000 iterations, random salt). Only your master password can decrypt it.
Your settings, trusted-sites list, and activity/tracker-block logs.
Your local license/activation status.

Stored on our servers

Your email address, license activation record (key hash, device identifier, plan, activation and expiry dates), and any uninstall feedback are stored in our database, hosted on Supabase (PostgreSQL). Access is restricted, credentials are stored only as hashes where applicable, and transport is encrypted (HTTPS/TLS).
Site-safety results are cached transiently to protect service quotas; they are not linked to your identity.

4. How we share your information (disclosure & third parties)

We do not sell your personal data, and we do not share it for advertising. We share the specific data below only with the service providers needed to deliver a feature you use:

Provider	What is shared	Purpose
Have I Been Pwned (haveibeenpwned.com)	Your email address (Pro breach check)	Check for known data breaches
Pwned Passwords (api.pwnedpasswords.com)	A partial, irreversible password hash prefix	Check if a password is breached (k-anonymity)
VirusTotal (virustotal.com)	The domain name only of a site you open	Detect phishing/malware sites
Supabase	Email, license/activation records, feedback	Our database and backend hosting
Resend	Your email address	Send breach alerts, renewal and update emails
Karl POS / Pesapal	Payment details you enter	Process Pro payments
Google Gemini (optional)	Only what you scan, and only if you use the optional AI scanner with your own Gemini API key	AI-assisted analysis you initiate

We may also disclose information if required by law, to protect our rights, or in connection with a business transfer, and only to the minimum extent necessary.

5. Data retention

Email address: retained until you unsubscribe or request deletion. Unsubscribing marks you inactive and stops all email.
License/activation records: retained for the life of the license so we can enforce one-user-per-key and manage renewals.
Domain reputation results: cached transiently (a few days) and not tied to your identity.
Locally stored data (vault, settings, logs) remains on your device until you clear it or uninstall.

6. Your rights and choices

Access, correction, or deletion of your email and account data — email us and we will action it.
Unsubscribe from emails at any time via the unsubscribe link in any message, or by emailing us.
Disable features — you can turn off phishing protection (which stops domain checks) and other features in the Extension’s settings at any time.
Depending on your location (e.g., GDPR/EEA, UK, or US state laws such as the CCPA), you may have additional rights to access, port, restrict, or delete your data; contact us to exercise them. We do not sell personal data.

7. Children’s privacy

The Extension is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

8. International data transfers

We operate in the United States and Uganda and use service providers that may process data in the United States and other countries. Where required, transfers are made under appropriate safeguards. By using the Extension you understand your data may be processed in these locations.

9. Permissions

The Extension requests host access so it can block trackers, apply fingerprint protection, and check site safety on the sites you visit. This access is used only for the privacy and security features described in this policy, and never to record, profile, or transmit your browsing.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by a new effective date at the top of this page, and, where appropriate, communicated by email.

11. Contact us

For questions, data-access, or deletion requests:

Email: samsoftware75@gmail.com
Sam Software LLC — 1942 Broadway, Ste 314C, Boulder, CO 80302, United States
Sam Software Ltd — Uganda