# Adapstory ISA: data handling

Adapstory ISA stores records in a local SQLCipher database on the user's Mac. The application saves its master password in an application-owned macOS Keychain item for automatic readiness. Encrypted backup files are saved to a location selected by the user and can be restored with their master password.

The Chrome extension exchanges messages with the installed local ISA Native Messaging host. It reports open tab IDs and URLs from the dedicated ISA browser profile to the local manager. The manager uses these URLs to check the destination before filling a selected account. The extension receives the selected fields and fills them into the matching page. The destination website receives data submitted to its forms under that website's own privacy policy.

The local MCP interface permits an explicitly authorized client to manage records and request secret fields. If a client requests secret fields, ISA returns them to that client. The client's handling of returned data is governed by its own configuration and privacy terms. ISA's delegated authorization lasts up to 48 hours; an explicit lock revokes it and blocks new operations across the application and adapters.

For explicit command execution, the manager can supply a selected credential to the child process through stdin or a restricted environment. The selected command can communicate with its requested service. An explicit GitHub CLI login can save that login using GitHub CLI's protected credential storage. Lock prevents new launches; an already-running child process continues.

ISA does not implement a remote vault service, advertising SDK, or first-party analytics endpoint. Browser automation adapters and the user's browser and connected services have their own data handling. The ISA Chrome profile is separate from the user's personal Chrome profiles.

Removing the extension or MCP plugin does not erase the local vault, backups, saved GitHub login, or browser sessions. The installation instructions describe how to remove ISA's own files and Keychain item. Preserve a verified encrypted backup and its master password before deleting local data.