API credentials are stored securely in browser storage, all communications use HTTPS encryption, and the extension doesn’t collect unnecessary user data.