Security & trust
NeXaKriya keeps a local task copy in the browser. Free uses that copy on one device; Plus and Premium can also sync a consented workspace through Firebase. Security is implemented in layers, with explicit limits stated below.
Current security controls
- Secure email-link or Google identity verification; neither method requires NeXaKriya to store a password.
- Encrypted, authenticated and time-limited NeXaKriya identity-session tokens.
- Google access tokens held only in browser session storage and revocable by the user.
- Progressive Google permissions: Basic access for an isolated app-created calendar, or optional Full integration.
- HTTPS enforcement, content security policy, clickjacking protection, restrictive browser permissions and reduced referrer disclosure.
- Same-origin checks, bounded input processing, server-side identity-to-email matching and active-plan checks for sync and Premium reminder actions.
- Confirmation before destructive calendar actions and separation of disconnect from deletion.
Data-boundary statement
Free task workspaces are stored in the browser. For Plus (Device Sync) and Premium, the user’s tasks and deletion markers are copied to a Firebase workspace after explicit cloud-sync consent; Premium activity-group names are synced there as well. Firebase also stores account and subscription metadata. Google Calendar API calls are made by the browser after authorisation, and Google access tokens remain in browser session storage. Premium reminder schedules send the owner’s email address and the required open-task snapshot to the email delivery provider.
Known limitations and user responsibilities
- Browser-local task data and Firebase workspace data are not presently encrypted by a separate NeXaKriya PIN. Device, operating-system, browser-profile and cloud-provider security therefore remain important. JSON backup and restore are available on Free and hidden for paid plans.
- A person or malicious extension with access to an unlocked browser profile may be able to read local data or act through an active session.
- Email delivery and Google services have their own security, retention and availability characteristics.
- No online system can guarantee absolute security. Controls and dependencies require periodic review and testing.
Report a vulnerability
Report suspected vulnerabilities privately to support@omnexagoc.com. Do not include passwords, access tokens, private calendar content or unnecessary personal data. Include reproduction steps, affected URL, likely impact and a safe proof of concept where available.