Sikurd / Legal
Sikurd 3CX Autofill — Privacy Policy
Last updated: May 18, 2026
Who this policy applies to
This policy covers the Sikurd 3CX Autofill browser extension, distributed via the Chrome Web Store and maintained by Sikurd. It does not cover the broader Sikurd portal at sikurd.com, which has its own privacy policy.
What the extension accesses
| Data | When it’s accessed | Where it goes |
|---|---|---|
| The hostname of the page you’re currently visiting | On every page load | Sent only to your own Sikurd backend to ask whether that hostname is one of your managed instances. Not sent anywhere else. |
| The list of 3CX FQDNs registered in your Sikurd account | Every 15 minutes, and on browser startup | Cached in chrome.storage.local on your computer. Refreshed from your Sikurd backend. |
| The 3CX administrator username and password for one instance | Only when you visit that instance’s FQDN | Fetched from your authenticated Sikurd session, written into the 3CX login form’s input fields, and discarded. Never persisted in extension storage. Never sent to any third party. |
| The contents of the 3CX login form on the page you are visiting | Only when the hostname is in your managed instance list | Used to identify where to write the credentials. No other page content is read. |
What the extension does NOT access
- Your browser history, bookmarks, or saved passwords.
- The contents of any page other than the 3CX login form on managed instances.
- Cookies, except indirectly — your Sikurd session cookie is attached by the browser to authenticated requests to your Sikurd backend, but the extension never reads its value.
- Any analytics, telemetry, or tracking systems. The extension makes exactly two kinds of outbound network calls: the FQDN list refresh, and the per-instance credential fetch. Both go only to the Sikurd backend URL configured in the extension’s popup.
Where data is stored
- On your computer, in
chrome.storage.local: the FQDN list and the URL of your Sikurd backend. Cleared when you uninstall the extension. - On Sikurd’s servers: the same data that already lives in your Sikurd account (instance records, encrypted admin credentials). The extension does not cause any new data to be stored there.
Data sharing
The extension does not share data with any third party. It does not sell, transfer, or transmit user data to any party other than your own Sikurd backend.
Permissions
The extension requests these Chrome permissions:
host_permissions: <all_urls>— required so the extension can recognise 3CX FQDNs at any domain. The content script bails immediately on hostnames that are not in your Sikurd-managed list.storage— caches the FQDN list and backend URL.alarms— schedules the periodic refresh of the FQDN list.
The extension does not request the cookies, tabs, history, bookmarks, or webRequest permissions.
Third-party services
The extension communicates with one server: the Sikurd backend whose URL you configure in the extension’s popup (default https://sikurd.com). All communication is over HTTPS.
The extension does not embed, load, or call any other third-party service — no analytics SDKs, no ad networks, no crash-reporting services.
Your rights
- Inspect everything the extension stores by visiting
chrome://extensions, clicking Details on Sikurd 3CX Autofill, and opening the developer tools. - Remove all cached data by clicking Refreshin the extension’s popup with no Sikurd account signed in — the cache empties when the refresh returns 401.
- Uninstall the extension at any time. Uninstalling clears all extension-side data immediately.
- Delete your underlying Sikurd account — which removes the source data the extension was caching — through the Sikurd portal.
Changes to this policy
Updates will appear at this URL. The extension itself does not need to be updated when policy text changes.
Contact
Questions about this policy: help@sikurd.com