Terms of Service & Privacy Policy

What we never receive

• Generated passwords, passphrases, PINs, WiFi keys and usernames. These are created by your browser's own random number generator. No request is sent when you generate one - You can disconnect from the internet and the tools still work.
• Anything you hash, encrypt, encode or strength-test. The MD5, SHA-256, AES-256, Base64, UUID, case-converter and strength-checker tools run entirely on your device.
• Passwords you check for breaches. The breach check hashes your password locally and sends only the first five characters of that hash to Have I Been Pwned's range API, which cannot identify the password. The comparison happens in your browser.
• Your vault contents in readable form. See the zero-knowledge section below.
• TOTP secrets sent to the 2FA API. Used in memory to compute or verify one code, then discarded. Never written to disk or logs.

Zero-knowledge encryption of the Password Wallet

When you create a vault, your browser stretches your master passphrase with PBKDF2-SHA256 (600,000 iterations) and a random salt into 512 bits, then splits them:

• The first 256 bits become your vault key. It never leaves your device and is never transmitted, in any form.
• The last 256 bits become an authentication key. Only this half is sent to us, and we store only a salted hash of it - Never the value itself.

Every item is serialized and encrypted with AES-256-GCM in your browser before upload. Our database column holds a single opaque Base64 blob per item. We can see how many items you have and when a row changed; we cannot see the name, username, password, card number, note or URL inside any of them. A full copy of our database would reveal nothing but ciphertext.

What we do store

• Account record: your email address, optional display name, the key-derivation salt and iteration count (both public parameters), a hash of your authentication key, and sign-in timestamps.
• Google sign-in: if you use it, we store your Google account identifier, email and name. Google authenticates who you are; it never gives us the ability to decrypt your vault, which still requires your passphrase.
• Vault items: encrypted blobs, their type label (login, note or card) and timestamps.
• 2FA API: your API key, a call counter, last-used timestamp, and - if you register one - The domain and URL where your attribution link lives, plus what we found there. To verify that link we fetch the public page you nominate.
• Contact form: whatever you write, plus the email you supply.
• Aggregate page counts: a per-day tally of how many times each page was requested. No cookies, no visitor identifiers, no per-person history - Just a number per page per day.
• Server logs: standard access logs (IP, path, user agent), retained briefly for abuse prevention and security investigation.

Cookies

One cookie: a signed session cookie that keeps you signed in for up to 30 days so a refresh doesn't log you out. It carries only your account identifier - Never your vault key. Your unlocked vault key is held in your tab's memory and cleared when you lock, sign out, close the tab, or after 10 minutes of inactivity. No advertising cookies, no cross-site trackers.

Analytics

We use a self-hosted Matomo instance for basic traffic measurement, and the aggregate page counts described above. Neither observes anything you type into a tool, because that data never reaches a server in the first place.

Sharing

We do not sell, rent or share personal data with advertisers or data brokers. Data is disclosed only where legally compelled - And in the case of vault contents, compulsion would produce ciphertext we cannot decrypt.

Your rights

You can delete your account, every stored item and your API key instantly from the dashboard under Settings - Deletion is immediate and permanent. You can also export your vault to a JSON file from the same screen (that export is decrypted in your browser and is not encrypted, so store it carefully). For access, correction or any other request, contact us and we will respond within 30 days.