Legal

Privacy Policy

Effective 3 November 2026

This policy explains what information passvault ("passvault", "we", "us") handles when you use the passvault app at passvault.ptechnology.org, the sign-up page, and the passvault command-line tool. Questions? Email hello@ptechnology.org.

1. Your vault (passwords, keys and notes)

Everything you save in passvault (entry names, usernames, websites, passwords, secret keys and notes) is encrypted on your device with AES-256-GCM using a random vault key. The vault key is itself locked by your passkey and by your recovery key. It is never sent to us, and we never have it.

The encrypted vault is stored in two places:

• On your device, in your browser's storage, so the app works offline.
• In your own Google Drive, as a single file called passvault.json, so your devices stay in sync.

We have no access to either copy. Google stores the encrypted file as part of your Google Drive and can't read its contents either.

2. Signing in with Google

When you sign in with Google, passvault asks for two permissions:

• See, edit, create and delete only the specific Google Drive files you use with this app (drive.file). passvault uses this only to create, read and update its own passvault.json file. It can't see any other files in your Drive.
• Your email address. This is shown in the app ("Signed in as…") and used to make the next sign-in quicker.

The sign-in token Google gives the app is kept only on your device and is used only to talk to Google Drive directly from your browser. It's never sent to us.

passvault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and we don't let humans read it.

You can remove passvault's access at any time at myaccount.google.com/permissions.

3. Face ID, fingerprint and passkeys

Unlocking with Face ID, Touch ID, a fingerprint or Windows Hello uses a passkey created and managed by your device's operating system. Your face or fingerprint is checked by your device and never leaves it. passvault never receives biometric data. It only receives a secret from the passkey that unlocks your vault, and only on your device.

Passkeys may be synced between your devices by Apple (iCloud Keychain), Google (Google Password Manager) or Microsoft, under their own privacy policies.

4. Your recovery key

Your recovery key is generated on your device and shown to you once. We don't keep a copy and can't recover it for you.

5. Beta sign-ups

If you sign up for the beta, we collect what you enter in the sign-up form: your Google account email address and, if you choose, your first name, the devices you'll use, and whether you'd like beta updates. The form is run with Google Forms, and responses are stored in our Google account.

We use this information only to:

• add your Google account to the list of approved beta testers (in Google Cloud), so you can sign in;
• email you about your beta access and, if you asked for them, occasional beta updates.

We keep sign-up information until the beta ends, or until you ask us to delete it, whichever comes first. We don't sell or share it with anyone else.

6. Hosting, logs and cookies

passvault is a product of P Tech (ptechnology.org). The website is hosted by Cloudflare. Like any web host, they may record technical information such as your IP address, browser type and the pages requested, under their own privacy policies. We don't add analytics, ad trackers or tracking cookies.

The app uses your browser's storage (IndexedDB and localStorage) on your device only, to keep your encrypted vault, your settings and whether you've already signed up for the beta.

7. Feedback

If you email us feedback, we use your message and email address only to reply and to improve passvault.

8. Deleting your data

• From a device: in the app, Settings → Sign out & remove from this device.
• From Google Drive: delete the file passvault.json in your Drive.
• Google access: remove passvault at myaccount.google.com/permissions.
• Beta sign-up: email hello@ptechnology.org and we'll delete it.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export the personal information we hold about you, or to object to how it's used. Since your vault is encrypted and only you can open it, the only personal information we hold is your beta sign-up. Email hello@ptechnology.org for any request, and we'll respond within 30 days.

10. Children

passvault isn't directed at children under 13 (or under 16 where local law sets a higher age), and we don't knowingly collect their information.

11. Security

passvault is designed so that a breach of Google Drive, our hosting or our sign-up list wouldn't expose your passwords, because your vault is encrypted with keys only you hold. No system is perfectly secure, and passvault is beta software, so please keep your recovery key safe and save a backup now and then.

12. Changes

If we change this policy, we'll update the date at the top. For important changes we'll tell beta testers by email or in the app.

13. Contact

Email hello@ptechnology.org.