Privacy Policy

This policy explains what CogVault does — and does not — collect when you use our desktop app, mobile app, and browser extension.

Information We Collect

CogVault is local-first. Vault data stays on your devices unless you opt into cloud sync.

• Vault contents — usernames, passwords, URLs, notes, and optional TOTP secrets — stored encrypted on your device only.
• Optional cloud sync — if enabled, only an encrypted vault blob is uploaded. We cannot decrypt it.
• No account profile — local use does not require an email, name, or registration form.
• No telemetry — we do not collect behavioral analytics, crash reports, or advertising identifiers.

How We Use the Information

• To encrypt and unlock your vault on your devices using your master password.
• To sync an encrypted copy across your linked devices when you enable cloud sync.
• To power autofill and save-login features in the browser extension from your unlocked vault.
• We do not sell your data, show ads based on vault contents, or use your credentials for marketing.

Security

Encryption and decryption run locally. We use AES-256-GCM with a key derived from your master password via PBKDF2. Because of this model, there is no “forgot password” recovery: if you lose your master password, we cannot restore your vault.

Third-Party Services

Optional sync uses Firebase (Auth and Firestore). Only ciphertext is stored there. The provider cannot read your passwords. The browser extension talks to those same endpoints only when you unlock and sync.

Cookies

CogVault apps and the extension do not use advertising cookies. Any session storage is limited to keeping you signed in to optional sync or remembering local preferences on your device.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page, with the “Last updated” date revised. Significant changes may also appear in app release notes.