Legal

Privacy Policy

Effective July 6, 2026 · Applies to the NexGate website, web application, and Chrome extension

The short version: NexGate collects no analytics, sets no trackers, and shares nothing with third parties. Your data goes to exactly one place — the NexGate server you (or your organization) run — and the sensitive parts are encrypted with a passphrase that is never stored anywhere.

1. Who we are

NexGate is a self-hosted password and multi-factor authentication manager published by Odoonex. Questions about this policy: [email protected].

Because NexGate is self-hosted, we — the software publisher — never receive, store, or have access to your data. All data described below stays between your browser and the NexGate server instance you connect to (for example gate.odoonex.app or your own deployment). The operator of that server is the data controller for your account.

2. This website

This site is static. It sets no cookies, runs no analytics, embeds no third-party scripts, fonts, or pixels, and makes no requests to any external service. Standard web-server access logs (IP address, requested page, timestamp) may be kept by the hosting infrastructure for security and reliability, and are not used for profiling.

3. The web application

When you use a NexGate server, it processes:

Account data — your name, username, email, a bcrypt hash of your account password, and sign-in metadata (time and IP of your last sign-in, failed-attempt counters) used for lockout protection and the security audit log.
Vault data — the app entries you save. Names, hostnames, and usernames are stored as you enter them; passwords and MFA secrets are encrypted with a key derived from your vault passphrase (PBKDF2-HMAC-SHA256, 600,000 iterations, per-user salt; Fernet authenticated encryption) before they are written to the database.
Your vault passphrase is never stored or transmitted for storage. It is used in memory to derive your encryption key and cannot be recovered, reset, or read by anyone — including server administrators. If email is configured, one-time codes for password reset and email confirmation are sent to your address; only their hashes are stored.

4. The Chrome extension

The extension is a client for your NexGate server. It communicates with that server only — it contains no analytics, no advertising, no telemetry, and no third-party network calls of any kind.

4.1 What the extension processes

Session cookie — after you sign in, your browser holds the same session cookie the web app uses, scoped to your NexGate server.
Vault passphrase — kept in the browser's in-memory session storage (chrome.storage.session) after you unlock. It is never written to disk, never synced, and is erased when the browser closes or you lock the vault. Web pages cannot access it.
The current tab's hostname — read locally to show the matching vault entry for the site you are on. Your browsing history is not collected, stored, or transmitted.
Login fields on web pages — the extension detects username/password fields so it can offer autofill and password generation. Page content is analyzed locally and never leaves your browser.
Credentials you submit — when you sign in to a website, the submitted username and password are held in extension memory for up to 3 minutes so NexGate can offer to save them to your vault. They are sent to your NexGate server only if you click Save; otherwise they are discarded. Dismissing the prompt discards them immediately.

4.2 Permissions, and why each one exists

Permission	Why the extension needs it
`storage`	Holds your vault passphrase in in-memory session storage while the browser is open. Nothing is written to persistent storage.
`tabs`	Reads the active tab's hostname to show the vault entry that matches the site you're on. No history is recorded.
`Host access to your NexGate server`	Sends API requests (sign-in, list, save, reveal, one-time codes) to the single server you configure — the only network destination.
`Content script on web pages`	Detects login forms to place the autofill icon, fill credentials you choose, generate passwords, and offer to save a just-submitted login. Runs locally; sends nothing off the page.

4.3 What the extension never does

No analytics, telemetry, crash reporting, or usage tracking of any kind.
No third-party servers, SDKs, ads, or data sharing — with anyone, ever.
No sale of data. Nothing to sell: we don't have your data.
No reading of page content beyond identifying sign-in forms.
No remote code: all extension code ships in the reviewed package (Manifest V3).

5. Data retention and deletion

Vault entries can be deleted at any time from the console or extension; deletion is immediate and permanent.
Deleting a user account removes the account and every vault entry it owns.
Locking the vault, signing out, or closing the browser clears the passphrase and any pending save from extension memory.
Server operators control database backups and log retention on their own infrastructure.

6. Security

Passwords and MFA secrets are encrypted client-of-the-database: the server's database and configuration alone cannot decrypt them. Accounts are protected by per-account lockout, per-IP rate limiting, and an audit log. The web application enforces a strict Content-Security-Policy with every asset self-hosted. Details are on the security section of this site.

7. Children

NexGate is a workplace/personal infrastructure tool and is not directed at children under 13.

8. Changes to this policy

If this policy changes, the effective date above is updated and material changes are noted here. Continued use after a change constitutes acceptance.

9. Contact

Privacy questions or requests: [email protected].