Privacy Policy

1. Overview

DyneBridge is a browser extension that lets the DynePass Android app fill your saved login credentials — a username or email address, and a password — into your browser, over your own local Wi-Fi network. This policy explains what data the extension handles, how it is protected, and what it never does.

2. What Data DyneBridge Handles

The only data DyneBridge's browser extension processes is the login credentials (a username or email address, and a password) that you choose to send from the DynePass Android app to a specific website you are actively logging into.

DyneBridge does not collect, and has no access to, any other information:

• No browsing history
• No analytics
• No device identifiers
• No account or contact information
• No financial data

If you install DyneBridge on Firefox, you may see "authenticationInfo" listed in the permission/consent prompt — that refers to exactly this: the login credentials described above — a username or email address, and a password — and nothing else.

3. How Your Data Is Protected

3.1 End-to-End Encryption

Credentials are encrypted on your phone using AES-256-GCM, with the encryption key derived from an ECDH (P-256) key exchange that is bootstrapped by scanning a QR code — a channel only your phone's camera and your browser can see. The extension is the only party able to decrypt the credentials; no intermediate component ever has access to the plaintext or to the encryption key.

3.2 Local Network Only

All communication happens over your own Wi-Fi network, between your phone and your computer. Credentials are never sent to DyneBridge, to any developer-operated server, or to any third party over the internet.

3.3 Crypto-Blind Helper

A small helper program on your own computer passes encrypted messages between your phone and your browser, because a browser extension cannot accept network connections itself. Your browser starts the helper only when you open DyneBridge to pair, and it stops as soon as the transfer is done or the pairing session expires. The helper only ever sees encrypted ciphertext. It does not parse, store, or log the contents of any message it forwards.

3.4 Replay and Tamper Protection

Every credential message includes a sequence number and timestamp, checked before anything is accepted, and the phone's identity is authenticated during the initial handshake so a malicious device on the same network cannot inject or intercept credentials.

4. No Telemetry, Analytics, or Tracking

DyneBridge does not use analytics services, crash reporters, advertising SDKs, or any other form of tracking. The extension does not phone home, does not check for updates from a remote server on its own behalf (browser stores handle that), and does not transmit usage data of any kind.

5. Data Retention

DyneBridge does not store your credentials remotely — there is no server-side database, backup, or account system. Within your browser, the extension keeps the most recently received credentials in short-lived, session-only local storage (cleared automatically after a few minutes, or immediately when the browser session ends) purely so you don't have to rescan the QR code if you reopen the popup right away. This data never leaves your device and is never accessible to DyneBridge or anyone else.

6. Your Control

You initiate every credential transfer yourself, by opening the extension and scanning a QR code with your phone. Nothing happens automatically or in the background without that action. You can revoke the extension's access at any time by removing it from your browser, which deletes all locally cached data along with it.

7. Permissions This Extension Requests

• Active tab access: to detect which website you're currently on (so credentials are filled into the right page) and to fill the login form on that page.
• Content script on every page: DyneBridge's content script loads on every website you visit, not just the one you're logging into at a given moment — this is necessary because the extension can't know in advance which site you'll want to fill credentials into. On every other page, this script stays completely passive: it does not read the page, does not collect anything, and does not send anything anywhere. It sits inactive until it receives an explicit autofill message from the extension itself, and that message is only ever sent as a direct result of your own action — scanning the QR code with your phone. Nothing on the page is read, touched, or transmitted unless you've just done that.
• Native messaging: to start and talk to the DyneBridge helper program on your own computer, which forwards encrypted messages to and from the DynePass Android app. The extension does not request access to any website or network address for this.
• Storage: to keep the short-lived, session-only credential cache described above.

No permission is used to collect or transmit data anywhere beyond your own devices.

8. Your Rights (EU/GDPR, California/CCPA, and Similar Laws)

Laws like the EU's GDPR and California's CCPA give you rights over your personal data — typically the right to access, correct, delete, or port a copy of what a company holds about you, and the right to opt out of the sale or sharing of your data. Here's how those rights map onto DyneBridge's architecture specifically, rather than generic language that wouldn't be accurate here:

• Right to access / portability: DyneBridge has no remote copy of your credentials to hand over — they exist only on your own phone and, transiently, in your own browser's session storage. You already have full access to that data at its source (your phone and browser); there is nothing held elsewhere to retrieve.
• Right to correction: Because there is no separate stored copy, there is nothing for us to correct on your behalf — you manage and update your credentials directly in the DynePass Android app.
• Right to deletion / erasure: Uninstalling the extension clears its short-lived session cache immediately, and deleting data in the Android app removes it there. Since no copy is ever kept on any server we operate, there is no separate remote deletion request to make.
• Right to opt out of sale or sharing: DyneBridge does not sell, rent, or share your personal data with any third party, under any circumstances — there is no data-sharing arrangement to opt out of, because none exists.

In short: most of these rights are normally exercised by asking a company to act on data it holds in its own systems. DyneBridge doesn't have such a system — nothing about your credentials is retained anywhere outside devices you already control — so the practical effect of these rights is already the default state of the product, rather than something you need to request from us. If you believe this isn't the case, or have any other privacy question, contact us using the details below.

9. Children's Privacy

DyneBridge is not directed at children and does not knowingly collect any information from children.

10. Changes to This Policy

If this policy changes, the updated version will be posted at this same location with a revised "Last updated" date.

11. Contact

Questions about this policy or DyneBridge's data practices can be sent to: