Technical Architecture & Privacy Overview NexoPad is built with a strict privacy-first and local-first approach. Here is a technical breakdown of how the extension operates and handles your data:

Permissions Justification
"Access your data for all websites": This is strictly necessary to detect when you type a shortcut command (e.g., /hello) and instantly replace it with the expanded text in any input field or contenteditable element. It is also required to read on-screen elements for our dynamic variables (like extracting a name or company from the DOM) and to inject AI-generated text directly into your active tab.
Data Storage & Encryption All your snippets, clips, notes, and bookmarks are stored locally in your browser using IndexedDB. We do not have access to your vault. If you use the PIN lock feature, your data is protected using local encryption standards. For users on Pro/Teams plans utilizing cloud sync, data is encrypted securely in transit.
AI Integration (Bring Your Own Key) NexoPad acts as a direct, client-side bridge between your browser and the AI provider of your choice (OpenAI, Anthropic, Gemini, etc.).
Your API keys are stored entirely locally on your device.
We do not route your prompts, API keys, or AI responses through any NexoPad middleware servers. The requests go straight from your Firefox browser to the provider's official endpoints.
Performance The extension uses a lightweight background script (Manifest V3 compatible) to ensure minimal memory consumption, only activating the content scripts when a text field is focused or a shortcut is triggered. No background tracking or analytics injections are used.