How account and passport information are separated
Short version: your readable passport is encrypted on your device. Onexa centrally stores the minimum account information needed for sign-in and free early access. Sharing sends only information the participant approves, and access may expire or be revoked.
Understand local encryption, recovery files and passphrases first.
See what PostgreSQL, Google, email and legacy billing services process.
Review consent, expiry, revocation, exports and deletion.
Your device and encrypted vault
Passport answers, goals, appointments, notes and preferences are encrypted in browser storage on the participant's device. The vault passphrase is not stored by Onexa and cannot be recovered by support. Closing the app removes the readable key from memory; clearing browser data may remove the local vault.
A participant can create an independent passport recovery code while the vault is unlocked. The code protects an encrypted copy of the vault key and can be used to set a new passphrase. The code is shown once, is never sent to Onexa and must be kept privately. Signing into the verified email account can retrieve ciphertext, but email alone cannot decrypt or reset the passport.
An encrypted .onexa recovery file can be saved to a participant-chosen location. If optional cross-browser recovery is enabled, PostgreSQL stores an encrypted vault package, encryption metadata and timestamps. Encryption happens on the device before upload. A valid vault passphrase or independently saved recovery code is still required to read it.
Your central account
PostgreSQL stores the account name, email, participant/coordinator role, optional coordinator organisation, language and accessibility preferences, enabled sign-in methods, protected session records and operational timestamps. Password accounts store a salt and one-way scrypt password hash. Google-linked accounts store a one-way hash of Google's stable account identifier and the email supplied by Google; Onexa does not receive the Google password.
Older trial and subscription fields remain in the database for compatibility and audit continuity, but they no longer control access. New registrations do not create trial-history records. Current participant and coordinator features are available under free early access without a card or automatic charge.
Legacy payments
New Stripe checkout is paused during free early access. If an older account already has a Stripe customer or subscription, Onexa retains the identifiers and billing-portal link only so that person can manage or cancel that existing billing relationship. Stripe processes card and invoice data; Onexa does not receive complete card numbers.
Feedback and founding-provider interest
Feedback is voluntary. Onexa stores the account, category, feedback text, consent choices and submission time. Do not include health information, participant names, passwords, access codes or passport content. Support coordinators may separately register interest in a founding-provider pilot; this stores organisation, role, approximate team size, non-sensitive goals, contact consent and timestamps.
Sharing, reports and coordinator updates
Participant-approved reports and coordinator proposals are encrypted before central storage. Access codes are delivered separately and access can expire or be revoked. Audit history records who shared or proposed an update and when, while private coordinator notes remain encrypted in that coordinator's browser. A PDF is readable outside Onexa and cannot be recalled after download.
Email, phone and operational records
Welcome, successful sign-in/sign-out, coordinator-update and report-access notifications are queued centrally. The outbox stores recipient, message type, timing, attempts and a non-sensitive error; it must not contain passport or health content, vault passphrases or access codes except where the participant explicitly requests delivery of a report access code. If a participant turns on an email appointment reminder, Onexa temporarily stores the account email plus the reminder and appointment times; the appointment name, provider, questions and notes stay in the encrypted vault. Reminder emails use neutral wording. The SMTP provider processes the recipient and message.
SMS and WhatsApp are optional and off by default. If enabled, Onexa stores the verified mobile number in international format, separate channel-consent timestamps, quiet hours and delivery status. Twilio processes phone verification and the chosen message channel. Phone reminders use neutral wording and contain no appointment title, provider, notes or health information. Consent can be withdrawn in Privacy options. A phone number can help protect the account but can never decrypt the passport or replace the separately saved recovery code.
Hosting and reverse-proxy services may process IP addresses, timestamps and browser metadata.
Your choices
You can update account preferences, disable cross-browser recovery, revoke coordinator access, delete local vaults, export encrypted backups and delete the central account. Essential recovery, export, revocation and deletion controls are not conditional on feedback.
Account deletion
Account deletion removes the central account and sessions but does not delete local passport files from every device. Revoke active shares and delete local vaults separately. If an older Stripe subscription is still active, cancel it through Manage existing billing first.
Safety
This app is not an emergency service, diagnosis, clinical assessment or replacement for qualified care. For immediate danger in Australia call 000. Lifeline: 13 11 14.
Contact and help
For account, free-access or technical help, email support@onexa.com.au. Do not include passwords, recovery codes, access codes or sensitive health information in email. Support cannot decrypt the vault or see a forgotten recovery code.