Security
What it stores, what it asks for, and why
LiveVault has no backend, so most of the usual questions — where's the database, who can read it, what happens on a breach — don't apply. What's below is the honest version of what actually happens instead: where your data physically sits, what each of the four permissions is for, and what's deliberately not built.
Storage
Where a capture actually goes
- Where captures live
- Text and metadata (titles, URLs, tags, collections, notes) are written to this browser's chrome.storage.local. Screenshots and saved images are stored as binary data in this browser's IndexedDB. Neither ever leaves the browser.
- What's recorded per item
- The URL, a canonical URL where the page provides one, the page title, the domain, and a capture timestamp — written once, at capture time, and never silently changed later. Anything you edit afterward (a title override, notes, tags, a collection) is kept as a separate field, so an edit can't overwrite what was actually captured.
- No server, ever
- There is no backend for this product. Saving something is a local write, not a network request — it can't fail because a server is down, and there's no request to intercept in the first place.
- Search stays local too
- Search runs against the text already sitting in this browser's storage. It isn't sent anywhere to be matched, and there's no AI model involved reading your saved content.
Permissions
Every permission the extension requests
No permission on this list grants standing access to "read and change your data on all websites" — that request is deliberately avoided.
- activeTab
- Temporary access to the tab you just acted on — clicked the popup, used a right-click menu, or pressed the shortcut on. This is what makes every capture feature work without asking for standing access to every site you visit.
- scripting
- Runs a one-shot check on the active tab to read its canonical URL and favicon, or the text of a link/image you right-clicked. It's never registered as a persistent script and does nothing until you trigger a capture.
- contextMenus
- Adds the four right-click entries — "Save page," "Save selection," "Save link," "Save image."
- storage
- Access to chrome.storage.local, where every vault item's metadata lives, and to the change events the vault page listens for so it stays live across tabs.
- unlimitedStorage
- Lifts the default ~10MB ceiling on local storage, which screenshots and saved images would otherwise hit. Without it, captures would eventually start silently failing to save.
What's not here
What LiveVault does not do
No account, no email, no sign-in
There's nothing to register for, so there's no identity to collect in the first place.
No analytics, no telemetry
What you save, search for, or capture is not reported anywhere. There is no analytics library in this extension.
No background reading of your tabs
The extension is inert until you click its icon, use a right-click menu, or press the shortcut. It cannot read a tab you haven't just acted on.
No cross-device sync
Your vault lives in this one browser profile. That's a real limitation, not a hidden feature — see Backup below.
Not every image gets copied
Fetching an image's bytes is subject to ordinary cross-origin rules. When a host blocks it, that item keeps a live link to the original instead of a stored copy, and says so.
Backup and deletion
No server means no safety net but the one you make
- Uninstalling deletes everything
- There's no account to log back into and no server copy to restore from. Removing the extension, or clearing this browser's site data, permanently deletes the vault.
- Export is the only backup
- Settings has an Export button that writes every item, collection, tag, and saved image to a single JSON file you keep yourself. Import merges a file back in without deleting anything already there.
- Trash is a real staging step
- Deleting an item moves it to Trash first. It stays there, restorable, until you delete it permanently — at which point the record and any saved image are both actually removed, not just hidden.
Reporting
Found a vulnerability?
Email it. There is no bug bounty programme and no formal SLA, but reports are read and taken seriously, and I will tell you honestly whether and when it will be fixed.