Welcome to RexaKit! With 13+ local-first tools, we respect your privacy and represent a new era of software: Client-Side Sovereignty. This document outlines exactly how we handle (or don't handle) your data.
1. THE ZERO-DATA PHILOSOPHY
RexaKit is built on a "Local-First" architecture. This means:
- No Server Storage: Whatever you type, calculate, or play with stays on your machine. We have no database to store your Todo lists, birth dates, or journal trades.
- No Accounts Required: You don't need to sign up, sign in, or give us your email to use our tools.
2. LOCAL STORAGE, INDEXEDDB & COOKIES
We use standard browser technologies to enhance your experience:
- LocalStorage: We save preferences (like dark mode, custom themes, or your last Todo list items) directly in your browser's LocalStorage. This data persists on your device but is never sent to us. Clearing your browser cache will wipe this data.
- IndexedDB: Certain tools (Link Vault, Trading Journal, PDF Lab) use IndexedDB for high-capacity structured data storage. This data stays entirely in your browser and is never transmitted to our servers.
- Cookies: We do not use tracking cookies. Technical cookies may be used strictly for network performance (e.g., CDN caching).
3. REXAVAULT & GOOGLE DRIVE BACKUP
We offer a secure, optional synchronization system called RexaVault to back up and restore your tool data:
- Sovereign Cloud Storage: If you choose to sync your data, it is saved directly to your personal Google Drive account in a designated JSON file (
rexakit_backup.json). We do not own, maintain, or have access to any external databases where this backup is stored. - Per-Tool Granularity: You can select exactly which tools' data to include in the backup — Todo, Quick Note, Expense Tracker, Decision Matrix, Link Vault, Trading Journal, PDF Lab documents, and your workspace layout.
- Scoped Access (drive.file): When connecting your Google Account, RexaKit requests authorization only for the
drive.file scope. This grants permission to view, edit, and delete ONLY the specific backup files created by RexaKit. We cannot see, access, or modify any other files or folders on your Google Drive. - Direct Browser-to-Cloud Sync: The backup synchronization process is executed entirely on the client side (within your browser). Your credentials and access tokens are managed via Google Identity Services and are never routed through our servers.
4. THIRD-PARTY SERVICES
While the core app is local, we use a few essential web services:
- Fonts: We use Google Fonts for typography. Your browser may make a request to Google's servers to fetch font files.
- Google Identity Services: Used exclusively for RexaVault's optional Google Drive backup feature. Authentication happens client-side.
5. SECURITY
Because your data never leaves your device (unless synced to your own Google Drive via RexaVault), the security of your data is largely dependent on the security of your own device and Google Account. LocalStorage and IndexedDB data is sandboxed per browser origin and cannot be accessed by other websites.
6. CONTACT US
If you have questions about how RexaKit handles your data, reach out:
