From 625f08e4cc6e33a371a5575c7867a6861b2f022f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 26 Mar 2026 00:53:15 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20correct=20privacy=20note=20=E2=80=94=20s?=
 =?UTF-8?q?torage=20is=20unencrypted?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

browser storage.local is plain JSON on disk, not encrypted like
saved passwords (which use OS-level Keychain/DPAPI). Be honest
about the security model.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
---
 src/popup/popup.html | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/popup/popup.html b/src/popup/popup.html
index 2f8cfb7..fbddfb8 100644
--- a/src/popup/popup.html
+++ b/src/popup/popup.html
@@ -174,8 +174,9 @@
     <footer class="footer">
       <div class="privacy-note">
         Your data never leaves your browser. No servers, no tracking, no analytics.
-        Identity data is stored in local browser storage only — as secure as your
-        browser's saved passwords. Nothing is transmitted anywhere.
+        Identity data is stored unencrypted in local browser storage — anyone with
+        access to your computer could read it. This is the same as browser cookies
+        and localStorage, not as secure as saved passwords (which are OS-encrypted).
       </div>
       <a href="#" id="btnOptions">Options</a>
     </footer>