Privacy Policy

Effective date: October 18, 2026

Session Injector (“Session Injector”, “we”, “us”) is operated by Dev Outrage. This policy explains what information we collect when you use the Session Injector web dashboard at app.sessioninjector.com, the Session Injector browser extension, and this website (together, the “Service”), how we use it, and the choices you have.

If you have questions, contact us at ariel@devoutrage.com.

1. Who this policy covers

Clients — business owners who create an account on the dashboard, store logins, and invite virtual assistants.
Assistants (VAs) — people who install the browser extension and connect to a client’s workspace with an invite code. Assistants do not create an account.
Visitors to sessioninjector.com.

2. How password encryption works

Passwords you add are encrypted in your browser with AES-256-GCM before they are sent to us, using keys protected by your vault passphrase. We store only the encrypted result. We cannot read your saved passwords, and we cannot recover your vault passphrase.

When you give an assistant access, your browser shares an encrypted copy of the needed key with that assistant’s extension, which decrypts the password on their device to fill the login form.

Important limitation: once a password is filled into a website’s login form, it is present on that page, and a person using that browser may be able to reveal it (for example with the site’s “Show password” option). For your most sensitive accounts, we recommend using the platform’s own staff or delegate access, and changing passwords when an assistant leaves.

3. Information we collect

From clients

Account information: email address and password (your account password is handled by our authentication provider and stored as a one-way hash).
Vault data: your encrypted vault key and the settings needed to unlock it with your passphrase. We never receive the passphrase itself.
Saved logins: platform name, login web address, and username in readable form, and the password in encrypted form only.
Workspace data: access group names, the labels you give assistants, invite codes, and access rules such as shift hours, time zone, and allowed IP address ranges.
Billing information, if paid plans are enabled: plan, billing period, and identifiers from our payment processor. Card details are handled by the payment processor and never reach our servers.

From assistants (through the extension)

An anonymous device identifier created when the extension is first used, and a public encryption key for that device. We do not collect an assistant’s name, email, or password.
Login page addresses: when the extension detects a login form on a page, it sends that page’s address to our server to check whether the assistant has an assigned login for that website. If there is no match, we do not store the address.
Access log: when the extension requests a login that matches an assignment, we record the time, the website domain, the assistant’s IP address, and whether access was granted or refused (for example, outside shift hours). Clients can see this log.

Automatically

Technical data such as IP address, browser type, and request timestamps in our hosting and database providers’ logs, used for security and troubleshooting.

We do not sell personal information, and we do not use it for advertising.

4. How we use information

To provide the Service: sign-in, storing encrypted logins, sharing access with assistants, enforcing shift and IP rules, and showing the access log.
To send service emails such as account confirmation and password reset.
To keep the Service secure, prevent abuse, and fix problems.
To process payments, if paid plans are enabled.
To comply with legal obligations.

5. What the browser extension can access

The extension requests these permissions:

Access to websites (https): so it can detect login forms and fill an assigned login on the matching site. It only acts on login forms and only fills logins a client has assigned to that assistant.
Storage: to keep the device’s sign-in session and short-lived cached data on the device.
Active tab and scripting: to fill a login on the page you are on when you choose to.

The extension’s private decryption key is created on the assistant’s device and is never sent to us. The extension does not collect browsing history, page content, or anything typed into other websites.

6. How long we keep information

Account, workspace, encrypted logins, and the access log are kept while your account is active.
When an assistant is revoked, they lose access immediately; the related records stay in your access history.
If you ask us to delete your account, we delete your account data within 30 days, except where we must keep it to meet legal obligations. Copies in backups are removed as the backups expire.

7. Your requests

If you want a copy of your information, want something corrected or deleted, or have any other privacy question, email us at ariel@devoutrage.com.

Assistants: please include the invite code or the name of the client who invited you so we can find the right records.

8. Security

We use encryption in transit (HTTPS), encryption of saved passwords in the client’s browser, row-level access controls in our database, and limited access for our team. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use trusted service providers for hosting, database, and email to run the Service. They only process information on our behalf to provide the Service. Because of this, your information may be processed outside your country.

If you forget your vault passphrase, we cannot recover your saved passwords. Please keep it somewhere safe.

9. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

10. Changes to this policy

We may update this policy. If the changes are significant, we will notify clients by email or in the dashboard before they take effect. The effective date at the top shows when it last changed.

11. Contact

Dev Outrage — ariel@devoutrage.com