한국어 · English

Privacy Policy

Password Manager · package com.hyeonseok.passwordmanager
Effective date: August 10, 2026

Password Manager (the “App”) stores your accounts, passwords, and TOTP seeds encrypted on your device by default. Only when you turn on sync, Google/Apple sign-in identifies the owner of ciphertext, and Firebase Firestore stores account data encrypted on device, a sync key wrapped as nonce/ciphertext/MAC, the record IDs, update times, revisions, deletion states, the sync-key-envelope revision and random change ID, and cryptographic metadata—including KDF salt—needed for sync. Account names, passwords, and TOTP seeds remain only inside ciphertext. A limited set of data may be processed through third-party SDKs for crash reporting, usage analytics, payments, and optional sync.

1. Never collected or transmitted in plaintext

• Account names, passwords, and TOTP seeds: stored in an on-device encrypted database (SQLCipher). If sync is on, their contents are encrypted first and transmitted only inside ciphertext; the sync metadata listed below is sent in separate fields.
• Autofill identifiers: web domains, Android package names, and iOS service identifiers are stored as account metadata to match login screens. If sync is on, they are included only inside encrypted account records and are not sent in plaintext to analytics, crash reporting, ads, or payment SDKs.
• Your master password, database encryption key, and local backup files: not sent to Firebase Auth, Firestore, Analytics, Crashlytics, or payment SDKs.
• If app lock is enabled, PIN / biometric state is kept in the device’s secure storage.
• If you do not use sync, account data remains local-only.

Local handling by the Chrome extension

The Passwordmanager Chrome Extension works with the separately installed macOS desktop app for one purpose: filling a selected account into the current HTTPS login page at the user's request.

• Only after the user requests a search from the extension popup, the extension sends the exact HTTPS origin of the current top-level page to the fixed local Native Messaging host. The origin is used only to find an exact account match and is not stored by the extension or sent to a developer server.
• The page detector reports only whether supported username and password fields exist. It does not read or collect typed values, selectors, DOM text, HTML, or form contents.
• After the user selects an account, its username and password pass transiently from the running local app through the extension into the captured fields on the current user-selected page. The destination website can process the filled values, so use the feature only on sites you trust.
• The extension does not retain a vault, master password, key, account, password, origin, or browsing history in browser storage. It sends none of this data to Firebase, developer servers, analytics, advertising, crash reporting, or human review, and does not log related payloads.
• Candidate and request state remains in service-worker memory for at most 30 seconds. App lock, navigation, origin or document mismatch, iframe use, expiry, replay, or transport failure prevents credential delivery.

Information handled by the extension is used only to provide its disclosed single purpose and complies with the Limited Use requirements of the Chrome Web Store User Data Policy. It is not used or transferred for advertising, personalization, sale, credit assessment, or unrelated purposes. Removing the extension removes its browser components; separate local app data remains subject to the App retention and deletion policy below.

2. Data collected and transmitted

The App processes the data below through the listed third-party SDKs. However, generation/lifecycle-based remote deletion and reactivation and the related Firebase Functions are not yet active in production. The key epoch, generation ID, lifecycle state, temporary operation metadata, and lifecycle-specific limited-use App Check token/replay-protection processing described below apply only after that feature is activated in production and a user invokes the relevant flow. Separately, in app versions that include App Check, Firebase App Check—backed by Google Play Integrity on Android or Apple App Attest/DeviceCheck on iOS—may process app/device integrity signals that do not contain saved-account contents during initialization or token issuance.

3. Third-party sharing

The data above is shared with the following providers solely to deliver the related features. The App does not sell data.

• Google (Firebase): analytics, diagnostics, sign-in identifier processing, sync-data storage (ciphertext and metadata), and App Check/Play Integrity verification.
• Apple: Apple-platform app integrity verification through App Attest or DeviceCheck.
• Apple / Google: Apple/Google sign-in and in-app purchase processing.

See the Google Privacy Policy and Apple Privacy Policy.

4. Data security

• Accounts, passwords, and TOTP seeds are encrypted with SQLCipher and stored on the device by default.
• If sync is on, Firestore stores account data encrypted on device, a sync key wrapped as nonce/ciphertext/MAC, and required unencrypted sync/cryptographic metadata including the envelope revision, random change ID, and KDF salt. Account names, passwords, and TOTP seeds are not stored in plaintext.
• The master password is used only on device to wrap or unwrap the sync key and is never sent to the server. Encrypted sync data cannot be recovered if the master password is lost.
• When enabled by the user, app lock (PIN / biometrics) prevents unauthorized access at app entry.
• Copied passwords are automatically cleared from the clipboard after a short delay.
• Data sent over the network is encrypted in transit (HTTPS).

5. Retention and deletion

• Local data (accounts, passwords, and TOTP seeds) is deleted when you delete items in the App or uninstall the App.
• If sync is on, whether an item is deleted is synchronized in Firestore as unencrypted deletion-state metadata.
• The currently deployed remote-sync deletion flow is a point-in-time operation that deletes encrypted account records and wrapped-key ciphertext. If sync remains enabled on another device, that device may upload encrypted records again, so sync must also be turned off on those devices when deleting remote data. After the generation/lifecycle feature is activated in production, deletion will require recent reauthentication and App Check and will retain a non-payload lifecycle tombstone containing only the retired epoch, random generation ID, deletion status, and server time to block uploads from the retired generation.
• For Firebase Auth/Firestore account data or analytics/diagnostics deletion requests, contact us below.

6. Children’s privacy

The App is not directed to children and does not knowingly collect children’s personal data.

7. Changes

This policy may be updated to reflect legal or service changes. Updates are posted on this page with a revised effective date.

8. Contact

Privacy inquiries: me@nine20.net