Accounts and password hashes (salted PBKDF2) are kept only in this browser on this device. Sign-in codes are emailed through EmailJS when it is set up. There is no server of our own, so this is a front-end sign-in for the page, not a substitute for server-side security.