Privacy
Policy

Purpose

Cookie Share Next lets you save and switch authorized website login states across your browsers. The extension reads a login state only when you ask it to save or switch an account. Sensitive browser state is encrypted in the extension before synchronization. The service stores encrypted envelopes and cannot decrypt their contents.

Data the extension accesses

When needed for a feature you request, the extension may access:

• the active tab's URL, hostname, title, and icon to identify the current site;
• cookies for the current site, including HTTPOnly and partitioned cookies where Chromium grants access;
• same-origin localStorage and sessionStorage for the current site;
• extension settings, the server address, extension login session, and local encryption state;
• files you explicitly import or export as account backups.

The extension does not continuously scan tabs, collect browsing history, inject advertising, or use this data for profiling.

Data received by the official service

• OAuth provider, provider-specific account identifier, and login/display name. For Google sign-in, this may be the email address returned by Google.
• Encrypted account buckets, opaque bucket identifiers, ciphertext sizes, and timestamps.
• Cryptographic hashes of service session tokens and backup login keys. A plaintext backup key is displayed once and is not stored by the service.
• Short-lived OAuth state and exchange records.
• Account ID, API endpoint, and timestamp records used for request limits and security.
• The requesting IP address for short-lived login rate limiting and abuse prevention.
• Technical request metadata processed by Cloudflare while delivering and protecting the service.

OAuth access tokens are used transiently to request the minimum identity information and are not stored by Cookie Share Next.

How data is used

We use data only to authenticate users, link providers at the user's request, synchronize encrypted buckets, enforce quotas, prevent abuse, maintain security, diagnose operational failures, and provide requested import, export, switching, and deletion features.

We do not sell personal data. We do not use or transfer user data for personalized advertising, retargeting, credit decisions, or unrelated analytics. Humans cannot read decrypted cookies or browser storage because the service does not possess the vault password or decryption keys.

Encryption and security

Cookie values, saved browser storage, bucket names, and related account-state contents are encrypted inside the extension before upload. Vault passwords and derived decryption keys remain in the extension. The official service receives only encrypted envelopes for those contents, and network communication uses HTTPS.

No system can guarantee absolute security. Protect exported files, vault passwords, backup login keys, OAuth accounts, and devices with access to the extension.

Service providers and disclosures

• Cloudflare hosts and protects the official Worker service and D1 database and processes network and infrastructure metadata.
• GitHub, Google, or LinuxDo processes authentication when you choose that provider, under its own privacy policy.
• A user-selected self-hosted server receives encrypted bucket data when configured by the user; its operator controls that deployment.

We may disclose information when required by applicable law or when reasonably necessary to protect users, the service, or the public from security threats or abuse.

Retention

• Encrypted buckets remain until you delete them or the account is deleted.
• OAuth links and basic account metadata remain while the service account exists.
• Sessions and temporary OAuth records expire according to service configuration and are periodically removed.
• Login-attempt IP records are retained only for rate limiting and periodically purged after the protection window.
• API request-limit records are normally retained for seven days on the official service.
• Local extension data remains until cleared or the extension is uninstalled. Exported files remain where you saved them.

Your choices and deletion

You can delete individual or all encrypted buckets, unlink an additional OAuth provider, sign out, reset a backup key, remove local extension data, and uninstall the extension. Uninstalling does not automatically delete server-side data or exported files.

To request deletion of remaining official-service identity and server records, use the repository's private security-reporting channel. Never post cookies, tokens, backup keys, database exports, or other sensitive information in a public issue.

Children

Cookie Share Next is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Chrome Web Store Limited Use

Cookie Share Next's use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data obtained through extension permissions is used only to provide or improve the disclosed, user-facing account-state management features.

Changes and contact

Material changes will be published at this URL with an updated date. Privacy questions or requests may be submitted through the private security-reporting channel of the server repository. Public issues may be used for general, non-sensitive questions only.