What Coauth does
Coauth is a zero-knowledge password + passkey manager: it saves, autofills, and generates your website logins, and lets you share any login with a team, end-to-end encrypted. I collect the minimum needed to run that service. I do not sell your data, show ads, or track you across the web.
What Coauth stores
• Your logins and passkeys. Passwords, notes, and passkeys you save are stored in your vault. Secret material (the password, the passkey private key) is end-to-end encrypted before it is saved or synced; the Coauth servers only ever hold ciphertext.
• Identity. When you create an account, I receive your email address and a user ID (via the authentication provider, Supabase) to create your account and sync your vault. You can sign in with Google, or with a one-time code sent to your email address. If you use Google I never receive your Google password. If you use an email code, no password is stored at all.
• Team data. Team names, membership, roles, and an activity log of team actions — needed to make sharing work.
• Invites. The email address you invited and a one-way hash of the invite link's token, never the token itself. Alongside it Coauth stores a copy of the team key encrypted with a key derived from that token, so the person you invited can open it and I cannot. An invite expires 48 hours after it is sent. Because the link carries that encrypted key, treat an invite link like a password: do not forward it.
• The site (domain) and username of a login, stored as a non-secret index so the right login can be offered on the right site.
How Coauth reads web pages
To work as a password manager, Coauth's content script reads the username and password fields of a login form — only to (a) offer to save them after you submit (you click Save) and (b) autofill them when you pick a Coauth suggestion. It also renders Coauth's overlay during a passkey ceremony. It does not read other page content, and it transmits nothing without your action.
Anonymous usage analytics
To understand where new users get stuck during setup, Coauth records a few anonymous product events (for example: the popup was opened, sign-in was started, passkey setup failed). Each event carries only a random installation ID generated on your device, the event name, and the extension version. It is never linked to your Google identity, email, vault, passwords, passkeys, or the sites you visit, and it never includes any secret. I use it only to fix drop-off in onboarding, and the data is write-only from the app — an individual user's events cannot be read back out.
What Coauth does not do
• I do not collect your browsing history or read pages beyond login fields.
• I do not sell or rent your data to anyone.
• I do not use your data for advertising, profiling, creditworthiness, or lending.
Encryption (zero-knowledge)
Coauth is zero-knowledge: the Coauth servers never hold a key that can decrypt your vault. Your vault is locked with a key derived on your device from any of three factors: a vault password you choose, a device passkey (WebAuthn PRF), or a recovery key that only you hold. Each factor unlocks the same vault, and none of them is ever sent to us. All secret material is encrypted with audited cryptography (libsodium) before it is stored locally or synced — only ciphertext reaches the Coauth servers.
Team-shared passkeys use a per-team key generated on a member's device and sealed individually to each member's public key. The plaintext team key never touches the server. A breach of the backend exposes only ciphertext.
What a vault password means for your risk
A passkey and a recovery key cannot be guessed. A password you can remember can be. The encrypted form of your password factor is stored in the vault data that syncs, so if the database were ever breached, an attacker could take that ciphertext away and try to guess your vault password offline, at their own pace, with no rate limit I can impose. That is not true of the passkey or recovery factors, and it is the one way in which choosing a password is weaker.
Two things reduce it, and neither is optional:
• Your password goes through Argon2id, a deliberately slow and memory-hard function, before it ever becomes a key. Each guess costs an attacker real time and 64 MB of memory rather than being free. The cost parameters are stored per password, so they can be raised later without locking anyone out.
• Coauth refuses a weak vault password rather than warning you about it, and the check runs where the key is derived, so the interface cannot skip it.
This is the same position every password manager that offers a master password is in. If you would rather not accept it, set up with a passkey and a recovery key and do not add a password — the choice is yours, and a vault with no password factor has nothing guessable in it.
Where data is stored
Encrypted vault data, team data, and account records are stored with Supabase (Postgres), region ap-south-1. Authentication is handled by Supabase Auth, either through Google or through a one-time code emailed to your address. Sign-in emails are delivered by Resend.
Permissions used
• webAuthenticationProxy — to act as a passkey authenticator so passkeys can be created, used, and shared.
• identity — used for the optional Google sign-in, to create your account and sync your vault. Signing in with an emailed code does not use this permission.
• storage — to store your encrypted vault and settings.
• activeTab — to show which of your logins/passkeys match the site you are currently on.
• Host access to the backend — to sync your encrypted data.
• Content script — to save/autofill logins on the sites you use, and show the passkey overlay.
Data sharing
I do not sell, rent, or share your data with third parties. Team-shared passkeys are shared only with the members of the teams you add them to, encrypted.
Your choices and data deletion
• Sign out to lock the vault and stop Coauth from handling passkeys.
• Remove a personal passkey, or unshare a team passkey, at any time from the popup.
• Delete your account and data: email me and I will delete your account records and vault data.
Data retention
Your account and vault data are kept until you delete your account. Team data is removed when the team is deleted. Audit-log entries are retained for the life of the team.
Children
Coauth is not directed to children under 13 and I do not knowingly collect their data.
Changes to this policy
If I make material changes I will update the "Last updated" date at the top of this page. Material changes will be noted in the extension.
Contact
Questions or data-deletion requests? Email kalpesh@buildifyapp.in. I respond to every real message.