Privacy Policy

1.Our approach

PockyPass ("we", "us") makes a password manager for Android, Windows, a browser extension and, soon, iPhone and iPad. PockyPass is built so that we never need your data: your vault is encrypted on your device, and we run no servers that store vault contents or user accounts.

A random 256-bit data key encrypts every vault entry with AES-256-GCM. That key is stored only in wrapped (encrypted) form, protected by your master password (PBKDF2-HMAC-SHA256, 600,000 iterations), by your recovery key and, if you turn it on, by a biometric key held in your device's secure hardware.

2.What we never receive

• Your master password, recovery key or encryption keys.
• The contents of your vault: usernames, passwords, notes, 2FA secrets or website addresses.
• Your vault file, encrypted or not.
• Your browsing history, the forms you fill in or your clipboard.
• Biometric data. Fingerprint and face checks happen entirely in your device's operating system.

3.Where your data is stored

Your vault is stored on your device in an encrypted database (SQLCipher). If you turn on sync, an encrypted copy (pockypass_sync.enc) is saved in your own cloud account, in an area reserved for the app:

• Google Drive: the hidden appDataFolder.
• Microsoft OneDrive: the app folder (approot).
• iCloud Drive (iPhone and iPad): the app's iCloud container.

You sign in to these providers directly (OAuth 2.0). Their sign-in tokens are kept on your device and are never sent to us. To let your other devices confirm your subscription, the file also contains your RevenueCat customer ID (a random identifier, see section 4) in unencrypted form.

4.Services we use

PockyPass relies on the following third parties. None of them can read your vault.

• Google, Microsoft and Apple store your encrypted vault file if you choose their cloud for sync, under their own terms and privacy policies.
• Google Play and the Apple App Store process payments and subscriptions. We never see your card or bank details.
• RevenueCat (RevenueCat, Inc.) checks whether your subscription is active. It receives a random customer ID and the purchase receipts from the store, and no vault data.
• Google Firebase (Realtime Database with anonymous sign-in) is used only while you activate the Windows app with your phone. The messages are end-to-end encrypted with a key shown in the QR code, expire after a short time and are deleted when pairing ends.
• Vercel hosts this website. Like any web host it processes technical data such as your IP address to deliver pages and protect the service.
• When the Android app checks whether another app may receive a website's password, it downloads that website's public /.well-known/assetlinks.json file directly from the website.

5.This website

The website uses no analytics, advertising or tracking. It sets one cookie, NEXT_LOCALE, to remember the language you chose. It is strictly necessary and contains nothing else.

6.No telemetry or advertising in the apps

The apps and the extension contain no advertising SDKs, tracking pixels or behavioural analytics. We do not know which websites you visit or which accounts you have.

7.Your rights

Because your vault never reaches us, you control it directly: you can view, export, change or delete it in the app at any time, and delete the synced copy from your own cloud account. For data held by the services in section 4, you can exercise your rights (for example under the GDPR or the CCPA) with them or through us. We do not sell or share personal information.

8.Children

PockyPass is not directed to children under 13 (under 16 in the EEA). We do not knowingly collect personal data from children.

9.Security

Keys are kept in the platform's protected storage: the Android Keystore, the iOS Keychain and Windows DPAPI. Locking the app removes the data key from memory. Copied passwords are cleared from the clipboard after a short time. PockyPass has not yet been audited by an independent firm.

10.Changes to this policy

We will post any change on this page and update the date above.

11.Contact

Questions or requests about privacy: hello@pockypass.com