Privacy Policy

Account Information

When you create an account, we collect:

• Email address (for authentication and communication)
• Subscription tier (Free, Pro, Team, Ultimate)
• Account creation date
• Last login timestamp

Payment Information

Payment processing is handled by Stripe. We do NOT store your credit card information. Stripe collects:

• Billing name and address
• Payment method details (stored by Stripe, not us)
• Transaction history

See Stripe's Privacy Policy

Encrypted Vault Data

Your passwords, secrets, and sensitive data are encrypted before leaving your device:

• Vault contents (passwords, notes, files)
• Master password (NEVER stored—we cannot decrypt your vault without it)
• Sync metadata (last modified timestamps)

Usage Data (Minimal)

We collect minimal technical data to operate the service:

• Feature usage (e.g., number of passwords stored, OSINT searches performed)
• Error logs (to fix bugs and improve reliability)
• Device type and OS version (for compatibility)

We do NOT track which specific websites you save passwords for, what you search for, or any behavioral analytics.

OSINT Research Data

When you use OSINT tools, searches are processed server-side to aggregate public data. We temporarily log search queries for:

• Rate limiting and abuse prevention
• Service improvement

Search logs are anonymized and deleted after 30 days.

What the extension stores locally

• Vault connection status (connected / disconnected)
• Vault lock state (locked / unlocked)
• Credentials queued while the desktop app was unavailable — stored temporarily until synced to your local vault, then deleted from browser storage

All of the above is stored in browser local storage (chrome.storage.local), sandboxed to the extension, and never transmitted anywhere.

Network requests

The extension makes zero network requests. It communicates only with the Nodus Vault desktop application on your computer via the browser's native messaging API — a local, OS-level channel that never touches the internet.

Queued credentials

If you save a credential while the desktop app is closed or the vault is locked, the extension holds it temporarily in browser local storage in plaintext until it can be handed off to the local agent, which encrypts it and writes it to your vault. Queued credentials are cleared from browser storage immediately upon successful sync.

With Service Providers

• Stripe: Payment processing (see Stripe's privacy policy)
• Email Provider (Brevo): Sending authentication emails and notifications
• Cloud Infrastructure (Turso): Database hosting for encrypted data

All service providers are bound by strict data processing agreements.

With Team Members

If you're part of a Team subscription, team owners and members can see shared passwords and data according to team permissions.

Legal Requirements

We may disclose information if required by law (court order, subpoena, etc.). We will notify you unless legally prohibited.

Business Transfers

If Nodus is acquired or merged, your data may transfer to the new entity. You'll be notified of any changes.

• We require a valid court order or subpoena before disclosing data
• We notify users unless legally prohibited (gag order)
• We provide only the minimum data required by law
• We publish a transparency report annually

Because of zero-knowledge encryption, we CANNOT decrypt your vault even if compelled by law. We can only provide: email, subscription status, last login time, and metadata.