Privacy policy
Short, without legal noise. If anything here turns out to be untrue, that is a bug to fix, not to explain away.
What we store
Your email address. Sign-in times and IP addresses. A list of devices with the names you gave them. How many records you have, their types and modification times. The size of each encrypted blob. Your encrypted second-factor secret.
What we cannot read
The contents of your records: host names and addresses, logins, passwords, keys. All of it is encrypted on your device with a key derived from your password. We do not have that key.
What is visible anyway
Blob size is metadata: it roughly tells whether a record holds a host or a private key. We have not padded records to a uniform size yet, but we say so plainly.
How long, and how to delete
As long as you use the account. Delete it and records, devices and tokens go immediately, sign-in log rows are anonymised, and backups expire within their retention period.
Who we share with
Nobody. No visitor counters or third-party trackers on this site, no telemetry in the app: a crash report is a file on your disk, sent only when you press the button and only to the address you entered.
Your password
A password is not reset by email: the server knows neither your password nor the key to your data. Access to the data can only be regained with the recovery key: it is issued at registration, and if you do not have one you can issue a new key in the cabinet while you are signed in. With neither the password nor the key, the data in the account is lost. What stays on the device is your local data; if it is under a master password, that has its own recovery key.