LEGAL

Privacy Policy

Effective and last updated: October 23, 2026

Lockstep is designed to generate authenticator codes locally and to keep your TOTP secrets encrypted end to end. Some account details needed to synchronize and display your vault are stored on the server in readable form, as described below. This policy explains what data is handled, why it is needed, and the choices available to you.

Information Lockstep handles

• Google account information: your stable Google account identifier, email address, and display name are used to sign you in, identify your vault, and display your welcome message. These are stored on the Lockstep server with your account record.
• Authenticator information: to provide your authenticator vault, Lockstep stores each entry’s encrypted secret and its encrypted issuer and account label (for example the service name and your email address or username), with their encryption IVs and key version. The following fields are not encrypted and are readable on the server: TOTP algorithm, digit count, period, and synchronization metadata such as entry IDs, timestamps, and short-lived records of deleted entry IDs (removed automatically after about two days). Entries saved by older versions of Lockstep may still have a readable issuer and account label until a current version re-saves them encrypted, which happens automatically the next time you unlock.
• Security information: Lockstep stores on the server an encrypted, wrapped vault key with its wrapping parameters (it can only be unwrapped with your passphrase, which never leaves your device), your lock settings (auto-lock timeout and whether to lock when your device screen locks), and a hashed session token with its last-updated time for each signed-in client (one for the web app and one for the extension). Your Lockstep passphrase is never sent to the server. Your unwrapped vault master key, recovery key, plaintext TOTP secrets, and generated verification codes are not stored as readable server data. Signing out deletes that client’s session record on the server.
• Local preferences: theme, device-local account order and pins, a copy of your lock settings, encrypted offline vault data, and pending synchronization operations may be stored on your device. While the vault is unlocked, the web app keeps the unlocked vault key in the browser tab’s session storage so a page reload does not ask for your passphrase again; it is removed when the vault locks, you sign out, or the tab is closed. The extension keeps it only in the browser’s in-memory extension session storage, which is not written to disk and is not available to web pages.
• User-selected website content: when you explicitly choose Scan QR code, the extension captures the currently visible tab and lets you select a region. The screenshot and QR decoding are processed locally for that action and are not uploaded to Lockstep.
• User-selected screen content: on a laptop or desktop, the web app can scan a QR code from a screen, window, or browser tab that you explicitly choose to share. Frames are decoded locally and are not uploaded to Lockstep; sharing stops after a successful scan, when you close the scanner, or when Lockstep locks.
• Device idle state: if you turn on locking when your screen locks, the extension uses Chrome’s idle API to detect that your device has locked or gone idle. This state is checked locally and is not sent to Lockstep.
• Operational information: Google Cloud, which hosts the Lockstep API and web app, may process ordinary request metadata such as time, IP address, response status, and technical error information for security, reliability, and abuse prevention. If your browser blocks content on the Lockstep website under its security policy, it sends Lockstep a short report (the policy rule, the blocked address, and the page and script addresses without their query strings), which the Lockstep API writes to its logs to detect problems and attacks; it contains no vault data.

How Lockstep collects information

Lockstep collects information only when you use a feature that requires it:

• From Google after you choose to sign in: Google Sign-In provides the account identifier, email address, and display name described above after you complete Google’s authentication and consent flow.
• Directly from you: authenticator account details are received when you scan or import a QR code, paste an otpauth:// URL, import a backup, or enter or edit an account manually. Passphrases and recovery keys are entered directly into the client and are processed locally as described in this policy.
• Through features you explicitly start: visible-tab or shared-screen content is accessed only after you start the corresponding QR scanner and choose the tab, screen, or window to process.
• Automatically while operating the service: Lockstep creates synchronization identifiers and timestamps, stores the local preferences and security state described above, and sends requests to the Lockstep API. The hosting provider may generate the operational request metadata described above.

Lockstep does not passively monitor browsing, collect browsing history, or access page content in the background. A visible-tab image is accessed only for the user-initiated QR scanning feature and is processed locally rather than sent to Lockstep or its service providers.

How information is used

Information is used only to authenticate you, provide and secure the authenticator vault, synchronize encrypted records between your Lockstep clients, restore pending offline changes, respond to support or security issues, and maintain service reliability. Lockstep does not use your data for advertising, profiling, credit decisions, or unrelated purposes.

Encryption and local processing

TOTP secrets are encrypted in the client with AES-256-GCM before synchronization. Verification codes, QR decoding, QR generation, backup creation, and backup import occur locally. The server receives encrypted secret ciphertext and the readable entry fields listed above, but it does not receive the vault master key required to decrypt that ciphertext. Anyone holding a recovery key or plaintext backup can access the associated authenticator secrets, so those exports must be protected.

Sharing and service providers

Lockstep does not sell personal or sensitive user data. Lockstep shares user data only with the following service providers, and only as needed to run the service:

• Google (Google Sign-In / OAuth): authenticates you and provides your Google account identifier, email address, and display name to Lockstep.
• Google Cloud Firestore: stores your account record, vault entries, lock settings, and session records described above.
• Google Cloud Run: hosts the Lockstep API and web app, and processes requests and their operational metadata, such as IP address and time.

These providers are operated by Google LLC and process data under Google Cloud’s terms. Data may be stored and processed in Google data centers outside your country. Lockstep does not share user data with advertisers, analytics providers, data brokers, or any other third party. Information may also be disclosed when required by law, to address fraud or security abuse, or as part of a business transfer with the notices or consent required by applicable law.

Retention and deletion

Synchronized vault data, account information, lock settings, and session records are retained while your Lockstep account exists. Device-local information remains until you sign out, reset the vault, clear the extension or browser storage, uninstall the extension, or remove the PWA data, depending on the data type. Use Lockstep’s reset-vault option to delete all of this server-side data for your account. Backups and recovery keys downloaded to your device must be deleted by you separately. Infrastructure logs may be retained for the period configured by the hosting provider for security and reliability.

Your choices

You may choose not to scan website QR codes and instead use manual entry, local QR images, or standard otpauth:// URLs. You may sign out, clear local browser data, uninstall the extension, or reset the synchronized vault. Because Lockstep does not hold your unencrypted vault master key, losing all provisioned devices and recovery keys can make encrypted records permanently unrecoverable.

Children

Lockstep is not directed to children under the minimum age required to manage their own Google account in their jurisdiction, and it does not knowingly collect data from children for advertising or profiling.

Policy updates

This policy may be updated when Lockstep’s features, providers, or legal obligations change. Material changes will be reflected by updating the date above and, when required, by providing additional notice.

Contact

For privacy questions or deletion assistance, contact the developer through the support contact shown on the Lockstep Chrome Web Store listing or the distribution page from which you obtained Lockstep.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.