Privacy Policy — Whisper Decrypt (browser extension)

Last updated: 16.08.2026

Whisper Decrypt is a browser extension that fetches a whisper.beer (or
compatible self-hosted whisper-backend) note's encrypted contents and
decrypts it locally in your browser. This policy covers the extension
itself. For how whisper.beer's server handles requests it receives (from
any client — a browser, this extension, the CLI, or curl), see
https://whisper.beer/privacy.

What this extension does NOT do:
- It does not collect, transmit, sell, or store any personal data of its
own, anywhere.
- It does not use analytics, telemetry, crash reporting, or any
third-party service.
- It does not have a backend, account system, or server of its own —
it only talks to the whisper API origin you're pointed at.
- It does not read or modify the content of any web page you visit — it
has no content scripts, and requests host access only for the specific
origin needed to fetch a note (see "Permissions" below).
- It does not read your browsing history, cookies, or other extensions'
data.

What it does do:
- When you paste a whisper note link and click "Fetch & decrypt", the
extension sends one HTTP request to that note's API origin (by default
https://api.whisper.beer, or another origin you explicitly point it at
for a self-hosted instance), asking only for that note's ciphertext by
ID. That request is subject to whisper.beer's own server-side handling
of IP address and User-Agent — see https://whisper.beer/privacy for
exactly what that server does and doesn't do with them (in short: never
logged/read by application code beyond real-time abuse rate-limiting,
auto-deleted within about an hour, never tied to note content).
- The decryption key is never included in that request. Nor is the note's
password, with one documented exception: for a "true end-to-end" note,
the server itself verifies the password (it holds no key to check a
derived value against) — the encryption key is still never sent, in
either mode.
- All decryption happens locally, in the extension's own popup, using
your browser's built-in Web Crypto API. Decrypted content is displayed
to you and is never transmitted anywhere.

Permissions:
- https://api.whisper.beer/* is requested at install time (a fixed,
single origin — not a broad wildcard) so that reading a whisper.beer
note doesn't require a permission prompt every time.
- Any other origin (e.g. a self-hosted whisper-backend instance) is
requested at runtime, per-origin, only at the moment you paste a link
pointing at it — the browser's own permission prompt names exactly
that host, once.

Source code: the entire implementation, including every claim in this
policy about what data is and isn't sent, is open source and auditable
at https://github.com/incatswetrust/whisper-extension