Cozybyte / Security
How Cozybyte keeps
your PC and data safe.
Cozybyte has no password to steal. You sign in with a passkey or a one-time email link, and nothing changes on your PC until you say yes.
Effective October 9, 2026
In short
- There is no password. You sign in with a passkey or a one-time email link. Passkeys
- Each request from the Windows app is signed with a key that cannot be copied off your computer, and you can revoke the computer in My Account. The Windows app
- Cozybyte runs as you. A repair that needs administrator permission runs only after you review it in Cozybyte and approve Windows' prompt, every time. Background checks only read. The Windows app
- Cozybyte reads things like disk, memory and connection, never documents, photos or browser history. Windows paths, email addresses and secrets are stripped before anything goes to an AI model. What stays small
This summary is to help you read the page; the full text below is what applies.
Passkeys
Sign-in can use a passkey or a one-time email link. Cozybyte stores the passkey public key and a counter that moves forward when you sign in. There is no password database to leak. A recovery link adds a passkey. It does not replace the ones already on the account, and it expires quickly.
Sessions and email
Your sign-in stays safe in your browser for 30 days, and every email link works only once. A sign-in link expires in 15 minutes, and the page asks you to continue so a mail scanner does not use it first. Confirmation, recovery, and email-change links expire on the timers in the Privacy policy. Repeated mail to one address is limited.
Technical details
The session cookie is signed, HttpOnly, and SameSite=Lax, and it is Secure on HTTPS. Email links are single use and Cozybyte stores only a hash of each.
The Windows app
After you approve the computer in your browser, the app creates a key that cannot be copied off the computer and signs every request with it, so a copied sign-in does not work elsewhere. Cozybyte stores only hashes of the app’s sign-in. Revoke the computer in My Account and its sign-in stops working.
Cozybyte runs as you, with your Windows account. A repair that needs administrator permission runs only after you review that exact step in Cozybyte and approve Windows' own prompt, every time, and never by itself under Fix it for me. Background checks only read. Cozybyte is not a Windows service and has no component that runs as the system.
Payments
Card numbers are entered on Stripe when payments are turned on. Cozybyte stores Stripe’s customer and subscription ids so it can tell whether the subscription is active, canceled, or ending. When Stripe is not configured, no card is collected.
What stays small
Cozybyte reads what it needs to explain a problem: readings such as disk, memory, processor and connection, and the names and sizes of apps. It reads no documents, photos, or browser history. Before anything goes to an AI model, Windows paths, email addresses, and secrets are stripped from it. Shared notes that could help another household are redacted, and they do not carry a household id.
If something looks wrong
If you see a passkey you do not recognize, sign in with one you do recognize and remove the other. If you cannot, use Account recovery from the email on the account. Revoke a computer you do not recognize. Write from that same email if a charge or a sign-in still looks wrong. Cozybyte will not ask you to send a passkey, a password, or a card number.
Questions? Read the help answers, or see how it works.