Skip to content
NXPanda
Menu

Cookie Panda privacy policy

Last updated Effective

This policy applies to the Cookie Panda Chrome extension, version 0.4.0.

In short: your data leaves your computer only in a file or clipboard text that you create and move yourself, or — only if you press Upload & get link — as an encrypted file stored on Cookie Panda’s server under your Google account. The key that opens that file stays in the link you hold (and, encrypted for their browsers, with the people you share it with); the server and the developer cannot read it. See “Opening a file shared with you in one click” for what this does not protect against.

What the extension handles

When you press Export, Cookie Panda reads the sites of your open tabs (all of them, or only the current tab’s site, as you choose), and then you pick which sites go into the file. For those sites it reads:

  • cookies, including sign-in and session cookies;
  • the sites’ localStorage, sessionStorage and IndexedDB;
  • the addresses of your open tabs, to find the sites. Only each site’s origin (for example https://example.com) goes into the file, never a page address or title.

The file also records when it was made, the browser’s user agent, the Chrome version and the extension version, so another copy of Cookie Panda can check it can read the file.

When you press Import, it writes the contents of a Cookie Panda file into the browser you are using.

This data is sign-in information: anyone who holds it can use your accounts. That is why the extension treats it as a secret.

Where the data goes

  • Nowhere over the network, unless you use “Sync by link”. The extension contains no analytics and no tracking, and it never sends your data to the developer or to anyone else except as described in “Sync by link” below. It does make the chosen sites’ own pages load in your browser (see “Tabs” below), just as if you opened them.
  • Into a file or the clipboard, only when you ask. The file is encrypted by default (AES-256-GCM, key derived from your password with PBKDF2-SHA256, 600,000 iterations). You can turn encryption off; the extension then shows a warning, because a plain file can be read by anyone who gets it.
  • Your password is never stored. It is kept only in the open panel’s memory while you use it, and is gone when the panel is reset or closed.

This feature is off until you use it. Uploading needs you to sign in with Google. Each link is either private (the default: it opens only for the same Google account that uploaded it and for the Google accounts you list under Share with) or set to anyone with the link (it opens for whoever holds the link, without signing in). You choose when you upload and can switch a file later in “My files”; the link stays the same. Your account, My files and Shared with me are on the extension’s own “Sync by link” page (its options page, also opened from the side panel, with Alt+Shift+L or from the right-click menu); the side panel and that page are the same extension and share its storage. Open on that page hands the file to Import in the side panel of the same window: the page tells the panel only which file, and the panel uses the link it already keeps (below); nothing new is stored or sent.

  • Sign-in. Cookie Panda asks Google for an ID token with the scopes openid and email. From it the extension learns your Google account id and email address. The token, account id and email are kept in Chrome’s session storage (in memory, cleared when the browser closes, or sooner when you sign out). The server reads the email from the ID token to match it against the files shared with you; it stores it only as described under What the server stores. So that you stay signed in after a browser restart or an extension update, the account id alone (no token, no email) is also kept in the extension’s local storage on that computer until you press Sign out; Cookie Panda then asks Google once, without a window, to sign the same account in again.
  • Upload. When you press Upload & get link, the extension packs the sites you picked into a Cookie Panda file, always encrypted (AES-256-GCM, PBKDF2-SHA256, 600,000 iterations) with a new random 256-bit key, and sends that encrypted file over HTTPS to the Cookie Panda server, with your ID token so the server knows which account it belongs to. The key is only in the part of the link after #, which browsers never send to a server; the extension never sends it either. So that My files can copy the link again, the browser that uploaded keeps each of its links (with the key) in the extension’s own storage on that computer, unencrypted, until you delete the file there; anyone who can read that browser profile can use them. Other browsers do not have them. For a private link, only someone who has the link and is signed in to the same Google account, or to an account you listed, can open the file. For a link set to anyone with the link, the link alone is enough — whoever holds it gets the sign-in it carries, so send it only to people you trust. Switching a file back to private stops new downloads; it cannot take back a copy someone already downloaded. To cut a link for good, delete the file.
  • Shared with you. When someone lists your Google address under Share with, “My files” shows that file under Shared with me, with its name, size, upload date and the sender’s Google email address. Likewise, the people you list see your email address with the file. The link and its key are not on the server, so the list cannot open the file by itself: the first time you open such a file from its link, the browser keeps that link (with the key) in the extension’s own storage on that computer, unencrypted, so Shared with me can copy it again (this also happens for a link to one of your own files uploaded from another browser). It is dropped the next time My files lists without that file, and forgotten with the rest when you delete your cloud account there.
  • Opening a file shared with you in one click. When you open My files signed in, the extension makes one key pair (ECDH P-256) for your Google account on that browser. The private key is kept in the extension’s own storage on that computer (IndexedDB) in a form no page or script can read out, and is deleted when you delete your cloud account there. The public key goes to the server with a random device id, your Google account id and email address, and when the device was last seen (at most 10 devices per account; the oldest is replaced). The browser that uploaded a file and holds its link then encrypts the file’s key for each registered device of each person listed under Share with and sends only that encrypted copy to the server — after an upload or a list edit, and each time My files is opened there. Your browser opens the copy made for it, rebuilds the link and keeps it like a link you opened yourself (above), so the row offers Open and Copy link. Open always stops at the preview of the file’s sites, even with fast import on, because anyone can list your address, so a file may come from someone you do not know (the sender’s address is shown). Removing an address, or deleting the file or either account, removes the matching copies; deleting your cloud account also removes your devices. What this does not protect against: the server decides which public key belongs to which address, and nothing checks this outside it. So someone who took control of the server (not someone who only reads its database) could register a key of their own for a recipient and receive the copies made after that, or give you a file of their own making for Open to show. A copy of the database alone opens nothing. A sender can also learn whether an address uses Cookie Panda, and on how many browsers, by listing it; to slow this down, an account can add at most 30 new addresses per hour to its lists.
  • What the server stores. For each file: the encrypted file, its name (made by the extension from the date and time), its size, its upload time and your Google account id, and whether the file is private or open to anyone with the link. If you list people under Share with, it also stores their email addresses and, while the list is not empty, your own email address, with that file only; both go with the file. If you put a file in a group (Set group in My files or Shared with me), it stores the group name you chose, unencrypted, with your account id and that file; each account’s groups are its own (the owner and the people a file is shared with never see each other’s), and they are deleted with the file or with your account. For each browser registered as above: its public key, device id, your account id and email address, and when it was last seen; for each such device a file is shared with: the encrypted copy of the file’s key, which only that device’s private key opens. To limit abuse it also keeps the times of your uploads and downloads for one hour, and each address you add to a list with the time you added it (counted for one hour, deleted within about two hours, and with your account). When a link is opened without a working sign-in (always for a link set to anyone with the link, as a first try for any pasted link while the panel is signed out, and when the signed-in account cannot open the file or has reached its own limit), the server counts the download against the downloader’s IP address. It stores a salted hash of the address (of its first half for IPv6) with the time, not the address in plain form, and deletes it after about an hour, normally within two. Such a hash is weak protection (someone with access to the database could work the address back out), which is why it is kept so briefly. It stores no password, no key it can use, no other email and no unencrypted cookies or site data, and it does not log request contents or tokens.
  • How long. A file stays until you delete it (“My files” → Delete). “Delete cloud account” removes every file and every record of your account; anything a failure leaves behind is removed automatically within 25 hours. Files are not deleted for inactivity. Records removed from the database (such as email addresses) can stay in Cloudflare’s restorable database history for up to 30 days before they are gone for good.
  • Who runs it. The server runs on Cloudflare (Workers, R2 and D1), which stores the encrypted files and records on the developer’s behalf. Google handles the sign-in under its own privacy policy.

What the extension keeps

  • While an export or import runs, a progress record is kept in Chrome’s session storage, which lives in memory and is cleared when the browser closes. It holds the site addresses, counts and the tabs being used, but no cookies or site data. When you press a keyboard shortcut (quick export, or open Profiles) or pick an item in the right-click menu, the window number, the time and which item you chose (this site, all sites, import, open Profiles, or the id of the profile to switch to) are kept there for a few seconds, until the panel picks the request up.
  • Your choices in the panel (language, which data types to include, whether to encrypt, and similar options such as fast import, skipping Google data or the last open tab) and the named site lists you save as templates are kept in the extension’s own local storage. A template holds site addresses only. If you use Profiles, the colour you give each profile and the sort order of the list are kept there too (a profile’s internal id and a colour number, no name), and Chrome’s extension storage keeps the ids of the profiles listed in the right-click menu so the menu can be cleaned up. None of this contains cookies or site data, and you can delete a template in the panel at any time.
  • While the panel stays open after an export, it keeps the finished file in memory so you can save or copy it again (unencrypted if you turned encryption off). Closing or resetting the panel drops it.
  • While the panel stays open after an import, it keeps in memory a copy of the cookies and localStorage that the import replaced on this browser, so that you can undo the import. This copy is never written to disk or sent anywhere; closing or resetting the panel drops it.
  • Profiles, only if you use them. When you save a profile, the extension keeps a snapshot of this browser’s cookies and the data of the sites open in tabs (Google account sites excluded, unless you turn on “Profiles include the Google sign-in”) and the list of open tab addresses, in the extension’s own storage on this computer (IndexedDB). The snapshot is encrypted with AES-256-GCM under a key protected by your vault password (PBKDF2-SHA256, 600,000 iterations). Profile names, the group you put a profile in, save times and counts are stored unencrypted. The password is never stored. After you unlock the vault, its key is kept in Chrome’s session storage, which lives in memory and is cleared when the browser closes; “Lock” clears it sooner. A deleted profile is kept in the open panel’s memory only, so you can undo the delete. Switching to another profile first saves the current state into the profile in use, then closes the web tabs and clears this browser’s browsing data (see “Browsing data” below) before restoring the other profile. Cookies of every site are saved first, but site data (localStorage, IndexedDB and so on) only for the sites open in tabs: the stored data of other sites is cleared and cannot be brought back. While a switch runs, a record of which profiles it goes between and how far it got (no cookies or site data) is kept in the same storage, so an interrupted switch can be continued or cancelled. “View” decrypts a profile in the panel’s memory only, to list its sites and counts. You can save a profile to a .cpanda file (encrypted by default with the password you type, like an export; it holds no list of tabs) or import a .cpanda file as a new profile, which is then stored encrypted in the vault like any other. Once you unlock the vault, the names of your profiles are shown in a “Switch to profile” item of Chrome’s right-click menu; locking the vault in the panel removes them, and after Chrome restarts they are removed the next time the panel opens. Picking one while the vault is locked only asks you to unlock it. While a switch runs, a short lock record (a random token, the time and the job number) is kept in session storage so two windows cannot switch at once. Nothing of this is sent anywhere.
  • Before an import, the panel reads this browser’s cookies for the sites in the file to show which ones are new, changed or identical. The comparison happens in the panel’s memory and is not kept.

Why it asks for its permissions

  • Read and change your data on all websites, cookies: to read and write the cookies and storage of the sites you export or import, which can be any site.
  • Tabs: to find the sites open in your browser. Export reloads a tab that Chrome has unloaded, so its storage can be read. Import opens background tabs of the imported sites (site storage can only be written from that site’s page), loading the site’s robots.txt or home page, and closes them afterwards, except a tab kept open for a site’s sessionStorage. Saving a profile records the addresses of the open tabs, encrypted, inside that profile; switching profiles closes the web tabs and reopens the other profile’s tabs.
  • Browsing data: only when you switch profiles, after the current state was saved encrypted in the vault. It clears websites’ local storage, IndexedDB, Cache Storage, service workers, file systems and the HTTP cache, including the data of installed web apps (Google sites included), so the next profile starts clean; cookies are removed separately, keeping your Google account sign-in cookies unless you turned on “Profiles include the Google sign-in”. It never clears the extension’s own data, passwords, history, downloads or form data.
  • Scripting: to run the extension’s own script inside those pages.
  • Identity: only for “Sync by link”: to open Google’s sign-in window and receive the ID token described above.
  • Debugger: only as a fallback, for tabs Chrome has frozen (which it wakes up) or pages that block injected scripts. It runs the extension’s own bundled script, only on the sites being exported or imported, and detaches when done (it also detaches any of its own sessions left over after a restart). Chrome may show a “being debugged” bar for a few seconds.
  • Storage, side panel: the progress record and the unlocked vault key above, and the panel itself (the “Sync by link” page also opens it, to hand a file to Import).
  • Context menus: to add “Export this site”, “Export all sites”, “Import a .cpanda file”, “Switch to profile” (listing your profile names once the vault has been unlocked) and “Open Sync by link” (the extension’s own page) to the right-click menu. They read nothing from the page.

Sharing and selling

The developer cannot read your data: files uploaded with “Sync by link” are encrypted with a key only your link (and the registered browsers of the people you share it with) holds; for files you share with listed accounts, see “Opening a file shared with you in one click” for the limit of this. Your data is never sold, shared, used for advertising, or used for anything other than copying your sign-in state where you choose. Cloudflare stores the encrypted files only to provide this service.

Your control

Nothing happens until you press Export, Import, Upload or a profile button. “Delete every profile” removes all saved profiles. Uninstalling the extension removes its settings and saved profiles. Files you exported remain wherever you saved them; delete them when you no longer need them. Uploaded files remain on the server until you delete them or delete your cloud account on the “Sync by link” page; uninstalling does not delete them.

Changes and contact

If this policy changes, the date above will change with it. Questions: contact@nxpanda.com.