Privacy Policy

1. Overview

This Privacy Policy explains how the Caudal AI - Auth Codes Chrome extension and its related authentication services process information.

The extension is intended for authorized contributors and administrators who have been provided access by Caudal AI or its authorized Operations team.

The primary purpose of the extension is to authenticate authorized users and provide contributors with access to authentication codes associated with their assigned accounts.

The extension is not intended for advertising, behavioral tracking, data brokerage, or unrelated consumer-data collection.

2. Information We Process

We process information that is necessary to provide authentication and account-access functionality.

2.1 Account Information

The system may process:

• Company or authorized email address
• Contributor name or account identifier
• Assigned project information
• Account status
• User role, such as Contributor or Administrator

2.2 Authentication Information

The system may process:

• Passwords entered by authorized users
• Authentication session information
• Authentication status
• Assigned authentication codes
• Information required to validate an active session

Passwords entered through the extension are transmitted to the authentication backend for account verification.

Passwords are not intentionally included in normal browser-visible API responses or application logs.

2.3 Administrator Google Sign-In

Authorized administrators may use Google Sign-In as an additional identity-verification layer.

When this feature is used, the system may process the verified Google account email address and authentication information required to verify the administrator.

Google Sign-In is used only for administrator authentication and access control.

3. How Information Is Used

Information processed by Caudal AI - Auth Codes is used only for purposes related to authentication and authorized account access.

These purposes may include:

• Authenticating authorized contributors
• Verifying administrator access
• Checking whether an account is active or offboarded
• Determining the contributor's assigned account
• Providing the authentication code assigned to that account
• Maintaining authenticated sessions
• Revoking access when account status changes
• Requiring reauthentication when credentials are changed
• Preventing unauthorized access
• Maintaining application security and reliability

4. Authentication Codes

Authentication codes are displayed only after successful authentication.

The application is designed so that contributors cannot choose another contributor's account when requesting an authentication code.

Authentication codes are not intended to be permanently stored in Chrome synchronized storage.

5. Temporary Login Form Storage

Chrome extension popups close automatically when users click outside the popup.

To improve usability, unfinished login-form information may temporarily be stored using Chrome session-scoped storage.

This temporary information may be cleared when:

• The user successfully logs in
• The user logs out
• The user clears the login form
• The user's access is revoked
• The session requires reauthentication
• The applicable browser session ends

Contributor passwords are not intentionally stored using Chrome synchronized storage.

6. Data Sharing

We do not sell user data.

Information processed by the extension is not used or transferred for:

• Advertising
• Behavioral advertising profiles
• Creditworthiness evaluation
• Lending decisions
• Purposes unrelated to the extension's authentication functionality

Information may be processed through infrastructure and service providers when necessary to operate the authentication service.

7. Google Services

The authentication system may use Google services for authorized operational purposes.

Google Sheets may be used by the backend as an authorized source of contributor account information such as email address, project, account status, password, and role.

The Chrome extension does not contain the private service-account key used by the backend to communicate with Google services.

Google identity services may also be used to verify authorized administrator accounts.

8. Security Measures

We use technical and organizational safeguards intended to reduce unauthorized access to authentication information.

These safeguards may include:

• Server-side authentication
• Role-based authorization
• Authenticated sessions
• Input validation
• Request-size limits
• Rate limiting
• Content Security Policy protections
• Cross-site scripting protections
• Restricted Chrome extension permissions
• Backend-only handling of sensitive configuration
• Automatic session revocation when account state changes

No system can guarantee absolute security, but reasonable safeguards are used to protect authentication information.

9. Account Offboarding and Access Revocation

Access may be disabled by authorized Operations personnel.

When an account is marked Offboarded or otherwise made inactive, the system is designed to prevent continued access to authentication codes after the updated account status is recognized by the backend.

Existing sessions may also be invalidated when relevant account passwords, permissions, or roles change.

10. Data Retention

Information is retained only as long as reasonably necessary to operate the authentication service, manage authorized account access, meet operational requirements, and protect system security.

Authentication codes are not intended to be retained permanently by the Chrome extension.

Account information maintained by authorized Operations personnel may remain available for operational, administrative, security, or audit purposes.

11. Chrome Extension Permissions

The extension follows a least-privilege approach and requests Chrome permissions only when needed for its functionality.

Permissions may include:

• identity — used for authorized administrator Google Sign-In.
• storage — used for temporary session-scoped extension state.
• alarms — used for periodic session-status checks.
• host permissions — used to communicate with the authorized Caudal authentication backend.

The extension does not require unrelated permissions such as browsing history, bookmarks, or unrestricted access to arbitrary websites for its authentication purpose.

12. Remote Code

Executable extension JavaScript is packaged with the extension.

The extension does not intentionally download and execute arbitrary JavaScript from remote sources.

Network requests are used to communicate with the authorized authentication backend and related identity services.

13. User Access and Questions

Authorized users may contact their Operations representative or the extension publisher regarding:

• Account-access problems
• Incorrect account information
• Authentication concerns
• Offboarding or status questions
• Privacy-related inquiries

14. Children's Privacy

Caudal AI - Auth Codes is an internal professional authentication tool and is not designed for use by children.

15. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes to the extension, infrastructure, security practices, or applicable requirements.

When changes are made, the updated policy will be published at this location and the Last Updated date will be revised.

16. Contact

Questions regarding this Privacy Policy or the Caudal AI - Auth Codes extension may be directed to the publisher using the verified contact information listed on the Chrome Web Store.

Contributor account and access questions should be directed to the appropriate Operations representative.