Privacy Policy

OneAccount (“OneAccount Vault”) is a secure vault for account credentials. We collect only what is needed to provide the service, we never sell your data, and we do not run ads or trackers.

1. Who we are

OneAccount is operated by Xupyter Solutions Pvt Ltd, Bharuch, Gujarat, India. The web app runs at one.xupyter.com (and one-account environments). The Chrome extension “OneAccount Vault” is the companion client.

2. Data we collect

2.1 Account & authentication

• Google profile — email, name, avatar via Google OAuth (NextAuth). Stored in users / accounts tables (prisma/schema.prisma: User, Account).
• Sessions — NextAuth sessions (Session) and Extension tokens (ExtensionToken: 14-day bearer token, hashed server-side, revocable from /dashboard / /api/extension/tokens).

2.2 Vault content (you provide)

• Spaces (Space) and Vault entries (VaultEntry): title, email, url, description, category/icon/color/logo, and password (encrypted at rest with AES-GCM; see Storage).
• Categories (Category) when you create them.

2.3 Extension local data

• Extension token in chrome.storage.local only (extension/utils/storage.ts:TOKEN_KEY = extToken). Never storage.sync.
• Current tab host (via chrome.tabs.query + activeTab) to prioritize site-matching entries — not persisted.

No advertising IDs, no third-party analytics SDKs, no fingerprinting.

3. How we use data

• Authenticate you (Google) and authorize vault/extension API calls.
• Store, list and decrypt vault entries only on your explicit “copy / reveal” action (GET /api/entries/[id]/credential, GET /api/extension/entries).
• Detect current site host to rank matching credentials first in the extension popup.
• Generate passwords/PINs/passphrases locally inside the extension (never sent to server until you save).

4. Chrome extension permissions — justifications

Declared in extension/wxt.config.ts:manifest.permissions and shown at install. Each has a narrow, user-visible purpose:

• storage — persist the short-lived extension bearer token locally; no sync.
• activeTab — read the active tab URL once to derive host for site-aware ranking. No content script, no DOM access, no history read.
• clipboardWrite — write email/password to clipboard only when you click “Copy”. Used via navigator.clipboard.writeText in the popup.
• identity — obtain Google id_token via chrome.identity.launchWebAuthFlow + getRedirectURL; exchanged at POST /api/extension/auth/google for an extension token (verified against AUTH_GOOGLE_ID).
• host_permissions https://one.xupyter.com/* (and https://*.xupyter.com/*) — communicate only with our backend (extension/utils/config.ts:WXT_SITE_URL). localhost is allowed only in dev builds.

No <all_urls>, no tabs history, no content-script injection, no remote code.

5. Storage & security

• Passwords encrypted at rest with AES-GCM (password column is @db.Text, base64 iv+tag+cipher); legacy plaintext is migrated on read/write. Decrypted only on the server after authenticating the request, then transmitted over HTTPS to your authorized session.
• Extension tokens are hashed (tokenHash unique) and expire in 14 days; you can revoke them from the dashboard. Last-used timestamp is recorded.
• All transport is HTTPS. NextAuth sessions are httpOnly, secure cookies.
• Clipboard writes are transient; the popup holds a revealed password in memory for 60s then clears.

6. Sharing & disclosure

We do not share your vault with third parties. We share data only with service providers needed to run the service (hosting Postgres/Next.js on your chosen deployment, email delivery if any) under confidentiality, or when required by law. We never use your data for ads or model training.

7. Data retention & deletion

• Vault data is retained while your account exists. Deleting a Space cascades its entries (onDelete: Cascade); clearing ExtensionToken logs you out of the extension.
• To delete your account and all data, contact hello@xupyter.com with subject “Delete OneAccount data — your email”. We confirm via your Google account before deletion.

8. Your rights

Depending on your jurisdiction (e.g., GDPR, India DPDP), you may request access, correction, export or deletion of your data, or withdraw consent by deleting your account.

9. Children

OneAccount is not intended for children under 13. We do not knowingly collect data from children.

10. Cookies

The web app uses strictly necessary cookies for authentication (NextAuth) and theme preference (heroui-theme in localStorage). No analytics cookies.

11. Changes

We will update this page and the “Last updated” date when practices change. Material changes are notified via the app or email.

12. Contact

Xupyter Solutions Pvt Ltd — hello@xupyter.com · +91 94287-14605 · NARMADA COMMERCIAL COMPLEX, M G ROAD, Panch Batti Cir, Bharuch, Gujarat 392001. For the extension’s store privacy disclosure, see also one.xupyter.com.

This policy is published at /privacy (canonical https://one.xupyter.com/privacy) as required for Chrome Web Store privacy practices. Last updated: September 14, 2026.