Privacy Policy for CtrlVouch

1. Overview & Zero-Server Architecture

CtrlVouch, developed and published by BooBilli ("BooBilli", "we", "us", or "our"), is a client-side browser extension designed for compliance auditors, security engineers, and GRC professionals to capture, watermark, and bundle screenshots mapped to SOC 1, SOC 2, and SOX audit controls.

CtrlVouch operates 100% locally inside your web browser. BooBilli does not operate any backend servers, analytics trackers, or telemetry endpoints for CtrlVouch. We never collect, transmit, view, store, or sell your screenshots, browsing activity, audit notes, or cloud storage credentials.

2. Data Stored Locally on Your Device

All data generated or configured within CtrlVouch is stored exclusively on your local device using standard browser storage APIs:

• Extension Settings & Custom Controls (chrome.storage.local): Your selected theme (Light/Dark), custom screenshot hotkey, auditor name/organization stamp text, and any custom audit controls you add. If you choose to configure direct cloud exports, your AWS S3 or Azure Blob Storage configuration parameters are saved strictly in your local browser profile (chrome.storage.local).
• Captured Audit Evidence Screenshots (IndexedDB): Captured PNG screenshots, SHA-256 integrity hashes, timestamps, and source URLs are stored locally in your browser's IndexedDB (CtrlVouchComplianceDB) until you export or delete them.

3. Data Transmission & User-Configured Storage Destinations

CtrlVouch only transmits data when explicitly triggered by you:

• Local Drive / ZIP Export: Saves the bundled .zip archive directly to your local filesystem using Chrome's Downloads API (chrome.downloads) or the HTML5 File System Access API (window.showDirectoryPicker).
• AWS S3 Integration (Optional): If you configure an Amazon S3 bucket and trigger an S3 upload, your browser communicates directly with Amazon Web Services (https://<bucket>.s3.<region>.amazonaws.com or your custom S3-compatible endpoint) using client-side AWS Signature Version 4 (AWS4-HMAC-SHA256).
• Azure Blob Storage Integration (Optional): If you configure an Azure Blob container and trigger an Azure upload, your browser communicates directly with Microsoft Azure (https://<account>.blob.core.windows.net) using your SAS Token or SharedKey signature.

No data ever passes through any server owned or operated by BooBilli.

4. Permissions Disclosure

CtrlVouch requests only the minimum Chrome permissions necessary to perform its single compliance function:

• activeTab & tabs: Used only when you press your capture hotkey or click "Capture Control Screenshot Now" to take a PNG snapshot of the visible tab (chrome.tabs.captureVisibleTab) and record the active tab's URL and page title on the audit evidence header.
• storage & unlimitedStorage: Used to store your extension preferences and local screenshot vault in IndexedDB so high-resolution audit screenshots are not lost before bundling into a .zip file.
• downloads: Used to save the bundled .zip archive to your local drive.
• host_permissions (<all_urls>): Used to listen for your custom screenshot hotkey on the web applications you are auditing and to allow direct HTTPS PUT requests to your own AWS S3 or Azure Blob Storage endpoints.

5. Data Retention & Deletion

• You can delete individual screenshots or click "Clear All" in the CtrlVouch Evidence Vault at any time to permanently erase all stored screenshots from IndexedDB.
• Uninstalling the CtrlVouch extension from Google Chrome automatically and permanently deletes all local IndexedDB databases and chrome.storage.local settings associated with the extension.

6. Changes to This Privacy Policy

If BooBilli updates this Privacy Policy, we will post the revised version on this page with an updated Effective Date.

7. Contact Information

For questions regarding this Privacy Policy or CtrlVouch, please contact BooBilli via the support section on the Chrome Web Store listing.