Privacy policy

Last updated: 2026-10-31

Keetar is a browser extension that reads and writes KeePass-compatible (KDBX4) password databases. There is no Keetar server, no Keetar account and no telemetry. This page describes what data the extension touches and where it goes.

Summary

• Your vault (titles, usernames, passwords, URLs, notes and attachments) is encrypted on your device and never sent to Keetar, because Keetar has no server to send it to.
• The extension makes a small number of network requests, described below, each triggered by a specific action you take.
• Nothing is sold, shared with advertisers or used for tracking.

What Keetar stores, and where

• Your vault file lives wherever you put it: a local file on your device or, if you connect it, a file in your own Google Drive.
• Vault contents are encrypted with the KDBX4 format and cryptography KeePassXC uses (Argon2id, AES-256 and ChaCha20). Your master password never leaves your device.
• Extension settings are stored locally in the browser's own extension storage and are never synced to a Keetar service.
• Biometric and hardware key unlock uses the WebAuthn PRF extension. The cryptographic material involved stays on your device and authenticator. On Firefox, these credentials are labelled with the domain keetar.com, but no request is made to that domain and no data is sent to it.

Network requests the extension makes

Breach checking

Sends a 5-character prefix of a password's SHA-1 hash, never the password or full hash, to api.pwnedpasswords.com (Have I Been Pwned). Only when you run a password health check.

Favicon lookup

Makes a normal, anonymous favicon request to the website an entry points to. Only when you fetch favicons for an entry or in bulk.

Cloud sync

Sends your still-encrypted vault file to and from Google's Drive and OAuth APIs on each read and write. The Google OAuth token is stored encrypted on your device, along with your Google account's email address, which is read from Drive and used only to renew that token for the right account. Only if you choose Google Drive.

Google Drive file picker

Loads Google's Picker through google-picker-bridge.papacodebear.workers.dev, a static page Keetar operates on Cloudflare. That page gets its own separate Google token, which stays on the page. Only the name and ID of the file you pick return to the extension. Only when you use the picker.

"Organize with your own AI" doesn't call any AI service. It generates a text export of titles, URLs and folders, never usernames or passwords, which you paste into an assistant of your choice yourself.

Google user data

This section applies only if you connect Google Drive.

• What Keetar accesses: the drive.file permission, which covers only files Keetar created or that you chose with the Google Picker, plus your Google account's email address. Keetar can't see the rest of your Drive.
• How it's used: only to read and save the vault file you selected, and to renew Keetar's access to Google Drive for the right account.
• How it's stored: the vault file stays in your Drive, with an encrypted copy cached on your device. The access token and email address are stored encrypted on your device. Nothing is stored on a Keetar server.
• How it's shared: Keetar doesn't share, sell or transfer Google user data with anyone, and doesn't use it for advertising or to train AI models. Your data is exchanged only between your browser and Google.
• How to remove it: disconnect the database in Keetar, uninstall the extension to clear its local data, and revoke access in your Google Account permissions.

Keetar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Keetar never does

• Send your master password, vault passwords or decrypted vault contents anywhere.
• Include analytics, crash reporting or usage tracking.
• Share data with advertisers or data brokers.

Permissions

Keetar requests browser permissions such as storage, tabs, clipboard write and host access only for what's described here: detecting and filling login forms, copying a password when you ask, and storing your configuration locally.

This website

keetar.com is a static site with no cookies, analytics, third-party scripts or accounts. It's hosted on Cloudflare, which may process standard technical request data, such as IP addresses, to serve and protect the site. The demo runs entirely in your browser using made-up data.

Changes and contact

If what Keetar does changes in a way that affects this policy, this page and the date above will be updated. Questions can be raised as an issue on GitHub.