What stays in your browser, what reaches our servers, and for how long.
Cloud Console Navi for AWS ("CCN", "we", "our", or "us") is a browser extension that enhances the AWS Console favorites bar. This Privacy Policy describes the data the extension and our website actually handle. It is written to match the code: if a feature is not listed here, it does not send data anywhere.
Key commitment: everything that configures the extension (favorites presets, custom service lists, service aliases, dropdown menu edits, settings) is stored in your browser. Light display preferences are also kept in your browser's own sync storage; if you use browser sync, your browser vendor (Google, Microsoft or Mozilla) carries them to your other devices under its own privacy policy, and we never receive them. The free features work completely offline. Account data reaches our servers only when you choose to sign in, subscribe, or send feedback. Without an account the extension still reads public reference data (the service catalog, the service status switch and settings), requests dropdown menus, checks a mailbox or an invite code at sign-up and looks up running campaigns. None of these requests carries account, role or resource data; our providers see the IP address of each request in their logs.
We collect the minimum needed for the optional features that talk to our servers, plus the technical and security data described below:
When you create an account we store your e-mail address and the authentication session in Supabase Auth, and a profile with your interface language and time zone (used for e-mails and reminder times), whether you have finished the getting-started tour, and your invite code. Sign-up starts a 14-day trial; to grant exactly one trial per mailbox we keep a trial record (e-mail address, trial dates and any other addresses the account later changed to) even after the account is deleted. To tell variants of one mailbox apart (for example plus-addresses or dots in a Gmail address) we also keep a canonical form of the address next to it, in your profile and in the trial record, and we decline a sign-up whose canonical form already has an account. At sign-up you may, if you wish, say where you heard about us (one option from a fixed list); we use it only to count which channels bring people. If you use an invite code, we record which account invited which, together with the invited e-mail address and its canonical form, so that each mailbox earns a reward only once; for one-time offers we keep only a hash of the canonical address (a pseudonymous identifier, not a keyed code). These records stay after account deletion.
If you set a password, Supabase Auth stores it only as a salted bcrypt hash. At sign-up we check the domain of your e-mail address against a list of disposable-mail providers. If you change your e-mail address, we keep keyed hashes of the old and the new address to enforce the change limit; they are deleted with the account.
To enforce the limit on signed-in browsers we keep, for each browser you sign in on, a random installation identifier, the browser name and version, the operating system, when it was last used, an optional label you give it, the identifier of the sign-in session that registered it and a hash of a secret that proves the browser's registration. Only signing out in that browser deletes its record: a browser that was signed out by the limit, by a plan change or by removal on the Account page stays listed until you delete your account.
If you subscribe, we store your plan, status and billing dates together with the customer and subscription identifiers assigned by our payment provider, Paddle.com (Paddle). Paddle is our reseller and the Merchant of Record for all orders; it collects and processes your card details, billing address and tax information. We never see your full card number; the payment events we receive may include the card type and the last four digits. We also keep a billing ledger (event type, amount, the account e-mail address at the time of each event, the e-mail address used at checkout and the provider's event payload) to answer billing questions and meet accounting obligations. If you cancel, we keep the plan, the time, the reason you choose and the optional comment you write until your account is deleted.
Bonus days you receive (the remainder of a trial, invite rewards, Prime offers) are recorded in a bonus-day ledger tied to your account. Prime offers and one-time lifetime-price credits are recorded against a hash of the canonical form of your e-mail address (a pseudonymous identifier, not a keyed code), so that each is used only once. If you buy with a campaign discount, we record the payment provider's transaction number, the plan, the amounts and the time. How long these records are kept is described under Data Retention.
The Feedback form sends us the e-mail address you enter, your message, the feedback type, the language of the page you sent it from and, if you attach them, screenshots. The extension also adds your browser user-agent string and the extension version so we can reproduce issues. If you are signed in, the message is linked to your account; the link is removed when you delete the account. Screenshots and a file copy of each message are stored in a private storage bucket; the file copy keeps the internal account ID until the copy is deleted after 12 months or on request. The notification e-mail we receive contains links to the screenshots that expire after 60 days.
If you switch on Settings Sync, the extension stores up to five named sets (by default) of its own preferences in our database: favorites bar layout and display settings, theme, region list, aliases and custom names, custom service lists, dropdown menu edits, key bindings, the rules that switch Vim keys off per service or page (these may contain AWS website host names and path patterns) and the interface language. With each set we store the identifier of the browser that wrote it last, so another browser you sign in on can adopt it. The extension never adds AWS account IDs, credentials or console content to a set, but text you type yourself (aliases, custom menu items) is stored as you typed it, so please do not enter such data. Switching sync off keeps the sets; deleting your account deletes them.
To deliver the service dropdown menus kept on our servers, the extension sends the public names of the services on your favorites bar (such as ec2), your console language and your time zone, whether or not you are signed in; the request contains no account, role or resource data. It is sent when your favorites bar gains a service whose menu is not stored in your browser yet, when you remove favorites, when our menu data has changed or a translation is needed, and when you open a menu from the command palette. The service catalog itself is refreshed at most once a day. Without an account, requests are limited per day using a keyed one-way code of your IP address and the day; the address itself is not stored and the code is deleted after about 3 days. Other requests made without an account (checking a mailbox or an invite code at sign-up, looking up running campaigns) are limited the same way, also using the extension's random installation ID. When you are signed in, the request is tied to your account: we record which services' menus your account received and when (until the account is deleted) and how many requests it made per day (30 days), and we update the time zone in your profile. When you are signed in and a service on your favorites bar has no dropdown menu in our data yet (for example a new AWS service), we record its public service identifier with a short code derived from your account and the service identifier. The code is stored without any account reference and is used only to count how many different users favorite the service, so we can add its menu; the record is deleted after 30 days without use.
We run no analytics, tracking or crash-reporting code, neither in the extension nor on this website. Our hosting providers keep standard, short-lived server logs (IP address, request path, time) to operate the service. Vim Mode's page hints read the structure (links and buttons) of the AWS Console and of the AWS websites the extension runs on (aws.amazon.com, the AWS documentation, the Health Dashboard, re:Post, the Pricing Calculator and the Switch Role page), in your browser only, to draw the letter hints; no page content is collected or sent anywhere. When you are signed in, we also record the on/off state of four feature switches (multi-row favorites bar, dropdown menus, Settings Sync, Vim Mode), only so we can see which features are used; this record is deleted with your account. We never store any cloud account data on our servers.
IP addresses at sign-in are used for security checks and to prevent abuse (for example mass sign-ups or one account shared by many people). We do not keep full addresses in our own tables: from the sign-in sessions of Supabase Auth we keep, for each account, a keyed one-way code of each full address and, as such and not hashed, the network of the address (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), with the time each address was first and last seen. Supabase Auth itself holds the address of a sign-in session for as long as that session exists. For each browser you sign in on, we also keep how often it signed in and how often the limit on signed-in browsers signed it out. From these and from account events we derive abuse signals, for example many sign-ups from one network, repeated refunds, invites between accounts that share an address, e-mail address changes or many feedback messages in a day; only we review them. The address codes (at most 100 per account) and the browser counts are kept for 90 days after they were last seen; signals based on a network are kept for 90 days and the other signals for 12 months; all are deleted with your account. This data is not used for advertising or profiling and is not shared with third parties.
The extension never sends us, and never uploads anywhere:
The extension keeps its data in the browser's extension storage (chrome.storage.local) and, for light preferences, in the browser's sync storage (chrome.storage.sync), plus short-lived page storage for sign-in state and interface state. This means:
This website sets no analytics or advertising cookies. Your language and day/night theme choices are remembered in your browser's local storage only. Our checkout page loads Paddle's checkout script, which sets the cookies Paddle needs to process the payment.
We rely on the following providers. Each receives only the data needed for the role described.
We encourage you to review the privacy policies of these services.
The data-collection declarations in the extension stores describe the same flows. On Firefox the extension declares four required categories, which cover normal use, and one optional category:
Chrome and Edge have no such switch, so the same data flows described in this policy apply there without a separate choice.
You may at any time:
To exercise these rights, e-mail privacy@console-navi.com from the e-mail address of your account. We may verify your identity first by sending a confirmation e-mail (a request not confirmed within 7 days is closed). We reply within 30 days, free of charge unless a request is clearly excessive.
How long each category is kept:
Controller: the controller of the personal data described here is Cloud Console Navi. You can reach us at privacy@console-navi.com.
We process personal data on these legal bases:
Providing an e-mail address is required for an account (sign-in, Prime, Settings Sync). The free features need no data from you.
Automated decisions: no decision with legal or similarly significant effect is made solely by automated means, except the mechanical limits described here (one trial per mailbox, the limit on signed-in browsers, quotas). You may ask for a human review.
International transfers: we operate from Japan. Our providers (Supabase, Amazon Web Services, Cloudflare, Google, ImprovMX, Paddle) may process data in the United States, the European Union, Japan and other countries. Where required we rely on the EU adequacy decision for Japan, Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable; details on request.
Children: the service is not directed at children under 16 and we do not knowingly collect their data; if we learn that we have, we delete it.
We do not sell or share personal information for advertising.
This page always holds the full current policy, and the "Last updated" date at the top shows the latest revision.