Privacy Policy

The server can't read your vault

Your master password is run through a key-derivation function on your device to produce an encryption key. That key, never the password itself, encrypts your vault locally using authenticated encryption with a fresh random value every time. Only the resulting ciphertext is ever sent anywhere.

A short, exact list

We collect the smallest set of information the product actually needs to work. Each item below is something we hold, and next to it is exactly what that means in practice.

What stays on your device and what reaches our servers

Aquera is built so the most sensitive information is handled locally wherever the product can do that. The distinction that matters is where each piece of information is processed, not simply whether the extension has access to it at some point.

Your master password, the key derived from it, and the plaintext contents of your vault are used on your device only. The server receives the encrypted result needed for storage and synchronization, together with the limited account and session information described elsewhere in this policy.

Also a short list

We don't collect anything beyond what's listed above. In particular:

• No analytics or telemetry of any kind.
• No browsing history.
• No advertising, no ad-tracking pixels.
• No third-party SDKs bundled into the extension.
• No data sold or shared with any third party.
• No fingerprinting or device identifiers used to track you across sites.
• No cookies set by this extension, on our own listing page, or on this policy page.

Only to run the product you asked for

Everything we hold exists for one of these reasons, and none other:

1. Authentication. Your account email and session tokens let you sign in and stay signed in.
2. Storage. Your encrypted vault is stored so it can sync across your own devices.
3. Account recovery. If you generate a recovery kit, the encrypted material it produces is stored so you can regain access if you forget your master password.
4. Session management. Device labels and session metadata let you see and revoke your own signed-in sessions from the extension.

We do not use your data to train models, build advertising profiles, or make automated decisions about you.

We don't sell or share your data

We do not sell, rent, or trade your data to anyone. We do not share it with advertisers, data brokers, or analytics providers, because we don't use any.

The only party that ever receives anything from this extension is our own backend, over HTTPS, and even then only ciphertext for your vault contents and your master password never at all. We may disclose account information if required to by a valid legal process, but we have no plaintext vault contents to disclose even if compelled, since we never possess your encryption key.

Every permission this extension requests, and why

How the extension interacts with websites

The extension needs access to parts of the current webpage to recognize login-shaped fields and provide autofill or save-credential functionality. This access is a product function. It does not mean the extension receives a copy of your browsing history or the contents of every webpage you visit.

Page interaction is tied to the extension's fill picker. Before sensitive information is returned, the request is checked against the browser-verified origin of the tab, so a credential stays associated with the correct website rather than treating every page as a valid destination. When the extension is locked, it does not expose saved passwords through the fill picker, and when there is no matching saved credential, the picker offers nothing for that site.

What the extension keeps locally

How information moves through Aquera

The privacy model is easiest to follow from the moment information is created to the moment it's removed. Sensitive vault information is handled on your device first. The server's role is to authenticate your account, store encrypted vault data, and synchronize that encrypted data between your own devices.

Passwords, passkeys, TOTP, and other vault items

The encrypted vault can hold several kinds of sensitive information: saved logins, API/OAuth credentials, secure notes, passkeys, and TOTP secrets. Every one of these is treated the same way: encrypted on your device before it's transmitted for synchronization. The privacy model doesn't change because an item happens to be a passkey or a one-time-code secret.

What happens when you lock, sign out, recover, or delete

Different account actions have different effects. Locking the extension protects the locally available vault by ending the unlocked state. Signing out or revoking a session stops that session from continuing to use the account. Recovery changes the account's authentication material and revokes every other active session, as described below. Account deletion removes the account and encrypted vault from production systems, subject to the backup-retention window described above.

Because Aquera never holds your master password or the key needed to decrypt your vault, recovery is not the same as a conventional server-side password reset. If you haven't generated a recovery kit and you lose your master password, we cannot decrypt the vault for you.

How long we keep what we hold

We keep your account and encrypted vault for as long as your account exists. If you delete your account, that data is removed from our production systems immediately; it may persist briefly in encrypted backups until those backups age out and are overwritten, after which it is unrecoverable by anyone, including us.

Session tokens expire on their own schedule and are revoked on explicit sign-out, on password recovery, or on account deletion. Recovery challenges (the short-lived proof used when redeeming a recovery phrase) expire within minutes and are single-use regardless of whether they expire first.

How we protect what little we hold

Because your vault is encrypted before it ever reaches us, our own security posture matters most for the account metadata we do hold (your email, session tokens, and encrypted vault blobs). We apply these measures:

• All traffic between the extension and our servers is encrypted in transit (HTTPS).
• Your vault is encrypted at rest using authenticated encryption, with a fresh random value for every encryption operation.
• Session tokens are checked against a live revocation list on every authenticated request, not just validated by signature, so a revoked session stops working immediately rather than at its next expiry.
• Recovering from a lost master password requires proof that you hold the correct recovery phrase before any new credentials are installed, and doing so revokes every other active session on the account.
• Deleting your account requires re-entering your master password first.

No system is perfectly secure, and we can't promise otherwise. What we can promise is that even in the event of a server-side compromise, an attacker would obtain only ciphertext for your vault, not your passwords, because we never hold the key that decrypts it.

What a server-side compromise would and would not expose

Our servers are designed to receive encrypted vault data rather than the plaintext contents of your vault. As a result, a compromise of a storage system would expose encrypted vault representations and the limited account information described in this policy, not a plaintext copy of your passwords and notes.

This encryption boundary reduces the impact of a server-side compromise, but it doesn't make every risk disappear. Accounts, sessions, devices, and recovery mechanisms still need to be protected, which is why the measures above exist for the information we do hold.

How AI is treated by the current product

The current product does not use your data to train AI models, build advertising profiles, or make automated decisions about you.

If AI-assisted functionality is introduced in the future, we will review the privacy implications before launch so this policy clearly identifies what information an AI feature can process, whether any external AI provider receives that information, how long it's retained, and whether it's used for model training. Introducing such a feature will never be treated as permission to expose plaintext vault contents or your master password unless this policy and the product's architecture are explicitly changed to support that.

If you forget your master password

Generating a recovery kit is optional. If you use one, a recovery phrase is created on your device. It's single-use: redeeming it installs a new master password and immediately revokes every other active session on your account. A fresh replacement phrase is issued automatically right after a successful redemption.

If you choose not to generate a recovery kit and later forget your master password, we have no way to recover your vault for you. This is a direct consequence of the zero-knowledge design, not an oversight.

Account deletion

You can delete your account at any time from within the extension, after re-entering your master password to confirm. This permanently deletes your account and vault from our servers, subject to the brief backup-retention window described above.

A simple privacy boundary

Zero-knowledge doesn't mean we receive no information at all. We receive the limited account and session information needed to operate the product. The boundary that matters is that our servers never receive the secret information required to read your vault.

Everything travels over HTTPS

All communication between the extension and its backend is encrypted in transit. The backend never receives your plaintext master password and never receives plaintext vault contents. It only ever receives ciphertext your device already produced.

Access, export, correction, and deletion

Regardless of where you live, we offer the same controls to everyone:

• Access. Everything we hold about your account is visible to you directly in the extension: your saved items, your devices and sessions, and your recovery kit status.
• Correction. You can edit or replace any saved item, your device labels, and your master password at any time.
• Export. Because your vault is end-to-end encrypted, we can't generate an export on your behalf without your master password; the extension itself is the tool for viewing and copying out your own data.
• Deletion. Delete your account at any time from the extension, as described above.
• Withdrawal of consent. Uninstalling the extension stops any further collection immediately; deleting your account removes what we already held.

If you have a request we haven't anticipated here, contact us using the details below and we'll do our best to help.

Not directed at children

This extension is not directed at, marketed to, or knowingly used to collect information from children under 13 (or the equivalent minimum age in your jurisdiction). If we learn that we've inadvertently collected information from a child, we will delete it.

Data transfers

Because your vault is encrypted on your device before it's ever transmitted, the practical privacy exposure of a cross-border transfer is limited to ciphertext and account metadata, not your actual passwords or notes. Where applicable law requires additional safeguards for transferring that metadata internationally, we take reasonable, appropriate steps to meet them.

How we'll tell you

If we make a material change to this policy, we'll update the effective date at the top of this page and, where required by law or where the change is significant, provide additional notice (for example, inside the extension itself). Continued use of the extension after a change takes effect means you accept the updated policy.

Questions about this policy