Privacy

This policy covers the Coeus browser extension and this website. Coeus has no accounts: there is nothing to sign up for and nothing to sign in to.

Accounts have ended#

Coeus accounts were discontinued on 6 November 2026. Website sign-in, the website dashboard, syncing through a Coeus account, connecting a browser to an account, the investigation workspace and packs published from an account have all been removed.

Data held for former accounts is being deleted from our active systems as the old service is shut down. That includes email addresses, sign-in details and passkeys, connected browsers, synced settings, sources and subscriptions, Saved backups and workspace records. It also includes the usage history the old service kept. Copies that remain in backups are deleted on their normal schedule.

What the extension keeps in your browser is not affected. Your settings, sources, subscriptions and Saved items stay where they were.

Browser extension#

Your settings, sources, subscriptions and Saved items are stored in this browser. Tool inputs, selected files and results are working-session data; they are not added to Saved or to the local search index. If you use Chrome sync, your settings and the sources you have not marked local only are also saved with Chrome's own sync storage, which Google stores and delivers to your other signed-in browsers. Coeus itself keeps no copy.

Coeus asks for no API key. There is nowhere to put one, nothing keyed is stored or sent, and any key a previous version had stored is deleted when you upgrade — its value is never read on the way out, and Coeus tells you once that it has gone. A source that will only answer its own account holders is a link you open yourself, in your own browser, signed in as you.

Removing the extension removes everything it stored in this browser.

Where the screens come from#

The Coeus screens — the side panel and the full-page Tools view — are pages loaded from this website into a frame inside the extension. Your browser keeps a copy, so after the first open they appear without the network. They are ordinary page markup, styles and data that your browser draws; the extension runs no code it did not ship. The framed page has none of the extension's own privileges: it cannot read your storage, your tabs or any page you are on, and it reaches the extension only through a fixed list of messages.

What this website sees when a screen opens is a request for a page and the version of the extension asking for it. No tool input, result, source lookup value, Saved item or setting is sent in that page request, and no cookie is needed or set. Everything the screens show is read from this browser and drawn here. If this website cannot be reached and your browser has no copy, the extension shows its own built-in screen saying so, with a Retry button.

Coeus also fetches one small configuration document from this website on the same schedule as its source packs: switches, default values, links and any notice to show you. It carries no cookies and no information about you. The extension also makes a simple daily check for a newer version, and on the same schedule as its pack refreshes it fetches the library of source packs and some reference lists from this website. None of those requests carries any of your data.

Tools, page suggestions and source tabs#

The side panel's tools process text, files and images in your browser. Tools analyse suitable input automatically as you supply it; opening a tool alone does not visit an external source. Its draft and result stay in the current panel session, including while you visit Settings and return. Closing the session removes that working data. Inputs entered into tools, file bytes and results are not put into a URL, the local search index or usage analytics.

The shared search checks text locally for a tool name or an indicator. Typing does not open a source. Choosing Open sources opens your enabled source pages in grouped browser tabs. Pasting a recognised indicator shows its detail in the side panel without opening source tabs. Choose a source or Open all sources in tab group to visit source sites. Those websites receive the selected value in the link and the normal network information of a page visit. A source requiring its own account uses that website's sign-in; Coeus does not collect an API key. Private-address restrictions still apply.

If you enable page suggestions, Coeus takes a bounded snapshot of visible page content for possible tool inputs. Hidden content, form fields, passwords and editable fields are excluded from passive suggestions. The suggested input is fetched from that page only when you choose to use it, and it can become unavailable after the page changes. A separate optional quiet notice can identify a visible password form whose declared destination uses unencrypted HTTP. It reads form attributes, not what you type. Showing, dismissing or pausing that notice never submits the form. You can pause notices for the exact site.

You can deliberately select text or an image on a page and open it in the side panel. The current context menu offers an indicator lookup; matching tool actions are available in the panel. A selected remote image may need to be downloaded from its host for local inspection. That host receives the normal network information needed to return it; these image requests do not include browser cookies or the page you came from. Local file selection avoids that request.

Coeus has website access so it can read the page you ask it to inspect and run the optional page features. It has no static content scripts; page readers are injected when requested or enabled. The extension does not submit forms, bypass a website's sign-in or automatically open source tabs because a page suggestion appeared.

Usage analytics and crash reports#

Anonymous usage analytics and crash reports help us see which features are useful and fix problems. They are on by default in the extension, and you can turn them off at any time in Settings → Privacy. The extension keeps working the same way either way.

What usage analytics contain#

When analytics are on, the extension records deliberate product actions, such as opening a tool, opening sources, changing a setting or completing the first-run tour. Each event holds only fixed details:

• the name of the event, from a fixed list;
• whether it happened in the extension or on this website;
• the extension version;
• a language label taken from your browser's first language preference, to help prioritise translations;
• a few properties chosen from fixed lists or broad ranges, such as a tool category or a count range;
• a random session reference that starts afresh after a period of inactivity;
• a one-way hash of a random installation identifier, so that distinct installations can be counted. The identifier itself is not kept.

Usage analytics never include search terms, indicators, tool inputs or results, file contents, page addresses or page content, names you give your own sources, copied text, typing or credentials. They carry no account identifier and use no cookies. Earlier versions of Coeus had an optional control for sending some search terms and source names; that collection has ended, and anything an older version still sends is discarded rather than stored.

The removal page works the same way. While analytics are on, removing the extension opens a page on this website that records the removal, the extension version and how long it had been installed, as a broad range. If you choose a reason, one answer from the displayed list is added. The installation identifier it carries is stored only as the same one-way hash. With analytics off, removing the extension opens nothing.

Older versions of the extension may still send smaller aggregate events with the feature used, a broad count range, the extension version, the browser family, the language label and a random installation identifier. They contain no investigation content either.

This website's own analytics#

This website counts page visits in the same way and in the same place, without cookies. A visit records the section of the site viewed, such as a tool, a doc or the blog, never the full address, and how long the page stayed visible, in broad steps. Searching the docs or the tools list records that a search happened, how many results it found and which result you chose, never the words you searched for. A random session reference is held in your browser's session storage for the visit. Nothing you type into the free tools is recorded.

This website can also send reports of its own errors so they can be fixed. These can include the page where the error happened and basic browser details.

Crash reports#

When something goes wrong in the extension and analytics are on, Coeus can send a crash report. It contains the type of error, where in Coeus's own code it happened, which part of Coeus was involved and the extension version. It does not contain error messages, page content, tool inputs or anything you were investigating. Not every error produces a report. Crash reports are used only to find and fix technical problems.

Retention and your choices#

Usage analytics are kept for up to three months. Non-identifying daily and monthly totals may be kept longer for comparing how Coeus is used over time. Like any internet request, analytics and crash reports include the network address needed to deliver them, but Coeus does not add it to what is stored.

Turning analytics off in Settings → Privacy stops both usage analytics and crash reports and clears any events waiting to be sent. Turning it on again starts a new installation identifier, so the two periods cannot be joined up, and does not upload activity from while it was off. Events already received are not removed when you turn analytics off; they expire with the retention period above.

The switch in Settings → Privacy covers the extension. This website's visit counting has no switch of its own; it is limited to the details described above.

The contact form#

The contact form asks for your name, an email address, a topic and your message. It is protected by an automated check against spam, which sees your network address and the browser details needed for that check. Your message is sent by email to the maintainer of Coeus, who uses it only to reply to you. This website does not keep a copy. You can ask for your message to be deleted at any time.

How information is used and shared#

We use information only to provide, protect and improve Coeus. We do not sell personal data, use it for advertising, determine creditworthiness or combine it with data bought from other companies.

Information is shared only with services needed to operate Coeus, when required by law, or with a source you deliberately choose to use. Those external sources apply their own privacy policies to requests you send them.

Children#

Coeus is intended for security professionals and is not directed at children.

Changes and contact#

Material changes will be noted in the changelog. For privacy questions or deletion requests, use the contact form. Do not include traced entities, internal hostnames or customer data in a message.