Privacy policy

1. Information we handle

• Account and company information: your name, email, organization, role, assigned properties, account permissions and access requests. LoginMax uses your existing LeadsMax identity to sign you in.
• Authentication information: sign-in details needed to authenticate you, temporary session and pairing credentials, company website usernames and passwords, website authenticator setup secrets, generated codes and encrypted prior passwords. Optional personal sign-in 2FA is handled through our authentication provider. When enabled, verification covers the current signed-in session without repeated checks for vault or setup actions.
• Website and form information: website origins used locally to match your assigned company websites, the active website origin sent when you open the popup or request a login, and supported username, password and confirmation fields on company websites where password updates are enabled.
• Activity and technical information: records of access requests, permission decisions, credential delivery, confirmed updates and security setting changes, with the relevant user, account and time. Hosting and authentication services may also process IP addresses, browser information, requests and technical or security logs.

When you import a company authenticator QR image, the web app decodes the selected or pasted image on your device. The image is not uploaded. Its decoded setup information is sent only when you save the company login.

Our extension does not request Chrome’s browsing-history permission or read your full browser history. Website matching happens locally against the authorized company website list. Unrelated browsing URLs are not sent to LoginMax by background website matching.

2. Browser access and password updates

Opening LoginMax’s popup lets it identify the active HTTPS website and find the company logins you are permitted to use. In version 0.1.3, choosing Fill login places the authorized username, password and current authenticator code into supported visible fields. Earlier versions offer separate login and code buttons. The extension does not submit the website’s login form for you.

Password updates are optional. Earlier extension versions enable them separately for each company website. Version 0.1.3 adds a one-time browser-wide website permission so newly assigned company websites can work automatically. After you allow that permission, the extension syncs the websites for company logins you can edit. It registers password-capture scripts only for those approved websites and checks your current account access again before staging a change.

The browser-wide permission covers HTTPS websites, but LoginMax does not activate password capture on unrelated websites. On an approved company website, a matched or selected password update is sent to LoginMax for encrypted staging. It replaces the shared password only after you confirm that the website accepted it. You can turn password updates off for the browser or remove website access in Chrome.

The extension uses active-tab access, bundled scripts and browser storage for these features. It connects to the LoginMax HTTPS service. Website permission does not grant access to company records: the service separately enforces the exact approved website origin, company membership and account permissions for each operation.

3. How we use information

We use information to authenticate you, apply company and property access rules, fill approved company logins, generate codes, process confirmed password updates, maintain protected history, record security activity, respond to support requests and operate or secure LoginMax.

Limited use: information obtained through the extension is used only to provide or improve its company credential features. We do not sell this information, use it for advertising or profiling, or use it for creditworthiness or lending decisions. We do not use company credentials to train general-purpose machine learning models.

4. Who receives information

Your organization and authorized teammates: available logins and account activity follow company membership, property assignments and explicit permissions. An authorized supervisor can use a shared login and its confirmed updates when access is granted. Filling a login delivers credential information into that person’s browser and the intended website.

Service providers: we use Netlify for hosting and server execution and Supabase for authentication and database services. Operational storage and recovery providers may process information needed to run and protect the service. They process data for those service functions. Information may be processed in countries where these providers operate.

Support, security and legal needs: access by service personnel is restricted to what is needed for authorized support, security investigations, service operation or legal obligations. We do not make company credentials public. Any transfer of extension data must be necessary for its stated features, security or legal obligations, or a lawful business transfer subject to this policy.

Websites you log in to, your organization’s other systems, Chrome and the Chrome Web Store have their own privacy practices.

5. Storage and security

Company passwords and website authenticator secrets are stored in an encrypted vault. Connections to LoginMax use HTTPS. Encryption keys are managed separately from the vault database, and credential delivery requires an authorized session and current access checks.

LoginMax is a server-managed vault. Its backend decrypts authorized credentials and generates authenticator codes to provide the service. Website authenticator setup secrets are not sent to the browser extension. Passwords and codes are delivered when an authorized user requests filling.

The extension keeps its temporary connection in browser session storage and its password-update preference in local storage. Older versions store enabled company website settings there. The updated extension refreshes its approved company website list for the current signed-in user. It does not persist company passwords or authenticator setup secrets in extension storage. The web app uses a protected sign-in cookie and local preferences for theme and the device setup invitation. We do not add advertising cookies or third-party advertising trackers.

Activity records are designed to record actions without passwords or authenticator secrets. No storage or transmission method can guarantee complete security.

6. How long information is kept

Company vault records, access information and audit activity are retained while needed to provide the organization’s service, maintain security or meet applicable obligations. There is currently no automatic general deletion period for all vault or audit records. Ask your organization or our privacy contact about a particular record.

• LoginMax keeps up to five encrypted prior passwords for a company login.
• Staged password candidates expire after 15 minutes and cannot be confirmed after expiry. Scheduled cleanup clears expired encrypted candidate contents; a delayed or failed cleanup can extend their storage, but not their validity. Non-secret candidate metadata may remain longer.
• Unstaged captured passwords stay temporarily in extension memory and are cleared when their pending state expires or is discarded, or when its background process restarts.
• Browser connections last at most 15 minutes. The web sign-in cookie persists across return visits and is renewed during use. Signing out, revocation or an authentication-provider expiry ends the connection.

Hosting logs and operational backup copies can have separate retention periods under provider settings and service needs. Deletion from an active service does not necessarily remove every backup copy immediately.

7. Your choices and requests

You can disable password updates for the browser, remove Chrome website access, disconnect or uninstall the extension, or sign out. Earlier versions also provide a per-website disable control. These actions stop the corresponding future browser access; they do not themselves erase existing company vault records or audit history. Personal LoginMax sign-in 2FA can be switched on or off in account settings with the verification required by your current setting.

Your organization manages company account access. Contact its administrator or our privacy contact to request access to, correction of or deletion of information, or to raise a privacy concern. We verify the request and coordinate with the organization, taking account of applicable security, retention and legal requirements.

8. Contact and policy changes

For LoginMax privacy questions, email attila@starrlive.com. Do not include passwords, authenticator setup secrets, recovery codes or current verification codes in your message.

We may update this policy when the service or its data practices change. The current version and update date will remain available on this page.