Privacy Policy
Last updated: 2026-10-24 · Parca is in controlled beta.
The short version: Parca exists to protect your data, so it collects as little as possible. It never reads your passwords, it never sells or shares your information for advertising, and you can export or delete what it holds at any time.
Who we are
Parca is a consumer-protection product operated by As a Service Enterprises. Questions: support@aaservent.com.
The Parca browser extension — what it sees
When you are on a sign-in, "allow access" (OAuth), or tech-support page, the extension looks at the context of that decision to tell you whether it's safe:
- the website address (domain) of the page you're on;
- where a sign-in form would send your credentials (the form's destination);
- the page's stated name (its title /
og:site_name); - for an "allow access" prompt, the app id and permissions being requested (from the page's web address).
It sends that context to Parca's own backend to check it against known-safe and known-malicious signals, and shows you a warning or the verified route. That's its only job.
What the extension never does: it never reads the value you type into a password or credential field — only that a field is present and where it points. It does not read your browsing history, your keystrokes, or the content of pages unrelated to a sign-in decision. It requests no special Chrome permissions and talks only to Parca's backend.
The Parca guardian (web app) — what you choose to give it
If you use the guardian to remove your exposed data or check breaches, you provide identity details (such as name, email, or address). These are held in a governed custody vault:
- Encrypted at rest (AES-256-GCM); we store ciphertext, not readable values.
- Used only to exercise a right you asked us to exercise or to check your own breach exposure — and only the minimum fields a given destination legally needs (for example, a data-broker opt-out never receives your SSN).
- Consent-bound and logged: every use is tied to a purpose you approved and recorded in an audit trail (by reference, never by value).
- High-impact or irreversible actions (like a credit freeze) always wait for your explicit approval.
Beta note (honest): during the controlled beta, Parca does not transmit your information to real data brokers or bureaus — that capability is built but switched off pending security and legal review. Today the only outbound use of a value you provide is checking your own email against a breach database, at your request.
What we never do
- We never sell your data or share it for advertising.
- We never read your passwords or credential values.
- We never share your data with a third party except to carry out an action you explicitly asked for (for example, submitting a removal request you requested).
Your rights — export & deletion
You can ask us what we hold and have it deleted. In the product these are the /v1/custody/export and /v1/custody/forget actions; or email support@aaservent.com and we will export or erase your data. Vault entries also expire automatically after a retention window.
Retention
Browser-extension checks are session-scoped and not retained as a profile. Guardian custody entries are retained only while your account is active, subject to an automatic expiry, and are hard-deleted on request.
Changes
We'll update this page as Parca leaves beta and more capabilities turn on; the "last updated" date above will change. Material changes will be surfaced in the product.