AEGIS LITE

DRAFT, review before launch. This document has not been reviewed by a lawyer.

Privacy Policy

Last updated: 2 November 2026

This policy explains how AEGIS Lite (the Chrome extension and this website) handles personal information. AEGIS Lite is made by Jeremiah Gad, a sole trader (ABN [ABN]) in Melbourne, Victoria, Australia (“I”, “me”, “we”). I aim to follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

The short version

1. What the extension sends, and to whom

Password checks: Have I Been Pwned (Pwned Passwords)

When you check a password (in the popup, in a Pro bulk check, or with Pro Live Guard), the extension turns it into a SHA-1 hash on your computer and sends only the first 5 characters of that hash to the Pwned Passwords API (api.pwnedpasswords.com), run by Have I Been Pwned (Troy Hunt, Australia) and served through Cloudflare. That 5-character prefix matches hundreds of different passwords, so it cannot identify your password. No cookies are sent with these requests. Like any website, the API receives your IP address and browser details as part of the connection; I don’t receive or keep these. See the Have I Been Pwned privacy policy.

Pro licence: Lemon Squeezy

If you buy Pro, the extension sends your licence key (and an activation ID it receives back) to the Lemon Squeezy License API (api.lemonsqueezy.com) to activate it, and again about once a week to check it is still valid. Nothing else is sent. Lemon Squeezy’s reply includes your name and email from the purchase; the extension ignores and does not store them.

Nothing else

The extension contacts no other servers. It has no analytics, crash reporting or advertising code.

2. What the extension stores on your computer

In Chrome’s local extension storage, on your computer only:

I can’t see any of this. You can remove the report in the extension, and uninstalling removes everything.

Bulk check files

Your password export (CSV) is read in the extension on your computer, checked, and then dropped from memory. It is never uploaded. The file stays on your computer, so please delete it (and empty the Bin) afterwards.

Live Guard (Pro, off by default)

If you turn Live Guard on, Chrome asks you to let AEGIS Lite read password fields on websites. When you type into a sign-up or change-password field, the password is passed inside the extension on your computer to be hashed and scored, and only the 5-character hash prefix is sent, as above. Nothing is stored. Turning Live Guard off removes the permission.

3. Buying Pro

Purchases are handled by Lemon Squeezy, which acts as reseller and merchant of record. Lemon Squeezy collects your name, email, billing details and payment information to process the order and GST, and sends you your licence key. I can see your order details (name, email, order number, country) in my Lemon Squeezy dashboard and use them only to provide support, licences and refunds, and to meet tax and record-keeping obligations. I never see your full card details. See the Lemon Squeezy privacy policy.

4. This website

This website sets no cookies and has no forms. It is hosted on Cloudflare Pages. Cloudflare processes your IP address and request details to deliver the site and protect it from attacks. The site may use Cloudflare Web Analytics, which counts page views and page performance without cookies, without fingerprinting and without tracking you across sites. See the Cloudflare privacy policy.

5. Email

If you email me, I receive your email address and whatever you write. I use it only to reply and keep it only as long as needed for support, refunds or legal records.

6. Third parties, named

Some of these companies are overseas (mainly the USA), so information they handle may be stored or processed outside Australia.

7. No selling, no ads, no tracking

I don’t sell, rent or trade personal information. I don’t use it for advertising, profiling or credit-worthiness, and I don’t allow anyone else to.

8. Chrome Web Store User Data Policy

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

9. Security

The extension follows Chrome’s strict security rules (no remote code), sends only what is described above over HTTPS, and is reviewed for security before release. No system is perfectly secure, but the design means there is very little to protect: your passwords are never collected.

10. Access, correction and deletion

You can ask what personal information I hold about you (usually only order and email records), ask me to correct it, or ask me to delete it where I’m not required to keep it (for example, tax records must be kept for 5 years). Email [SUPPORT_EMAIL]. I’ll respond within 30 days. You can use a pseudonym when emailing me, unless you need help with a purchase.

11. Complaints

If you think I’ve mishandled your personal information, email me first at [SUPPORT_EMAIL] with the details. I will acknowledge it within 7 days and aim to resolve it within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992.

12. Children

AEGIS Lite doesn’t knowingly collect information from anyone, including children.

13. Changes

If this policy changes, I’ll update the date above and, for important changes, mention it in the extension’s release notes.

14. Contact

Jeremiah Gad, Melbourne, Victoria, Australia. Email: [SUPPORT_EMAIL].