Privacy policy

Last updated 1 August 2026

Placeholder pending legal review. This document accurately describes what the software does today, but it has not been reviewed by a lawyer and the controller details below are incomplete. Do not rely on it as a finished legal notice, and complete it before taking paying customers.

Who we are

PassKrypt (the "Service") is operated by [legal entity name, registered address, company number, VAT number to be completed], acting as data controller for the personal data described here. Contact: privacy@passkrypt.com.

The short version

Your vault contents are encrypted on your device before they reach us, so we cannot read them. The personal data we do hold is the minimum required to run an account: your email address, your name, your plan, and technical records of syncing.

What we collect

Account data

  • Email address — identifies your account, sends verification codes, recovery links and service notices.
  • Name — as you enter it, used to address you and to personalise your Recovery Kit.
  • Authentication verifier and key-derivation parameters — a one-way value that lets us check your sign-in. It is not your password and cannot be reversed into one.
  • Plan and subscription status, including trial start and end dates.

Vault data

Your vault is stored as a single encrypted blob. We can see its size, its version number and when it last changed. We cannot see anything inside it.

Technical data

Server logs record IP address, timestamp, requested endpoint and response status, for security and abuse prevention (for example rate limiting). Logs are retained for up to 30 days. We do not log vault contents, passwords, verification codes or recovery links in production.

What we do not collect

No analytics, no advertising identifiers, no behavioural profiling, no third-party trackers. This website sets no cookies at all, which is why you were not asked to consent to any.

Why we are allowed to process it

  • Performance of a contract (Art. 6(1)(b) GDPR) — account data and encrypted vault storage; without these there is no service.
  • Legitimate interests (Art. 6(1)(f)) — security logging, rate limiting and abuse prevention, balanced against your interests and kept to the minimum.
  • Legal obligation (Art. 6(1)(c)) — retaining invoices and tax records for the statutory period.

Who else is involved

We use a small number of processors, each bound by a data processing agreement:

  • Amazon Web Services (Frankfurt, EU) — hosting and database storage.
  • Amazon SES (EU) — transactional email delivery.
  • [Payment provider — to be completed] — subscription billing. Card details are entered on the provider's own systems; we never receive or store them.

We do not sell personal data, and we do not share it for advertising.

Where it lives

Data is stored in the European Union (Frankfurt). Should any processor require a transfer outside the EEA, it will be covered by Standard Contractual Clauses or an adequacy decision.

How long we keep it

  • Account and vault data — for as long as your account exists.
  • After deletion — removed from live systems immediately, and from encrypted backups within 30 days as those backups age out.
  • Server logs — up to 30 days.
  • Invoices — as long as tax law requires.
  • Abuse-prevention record — when an account is deleted we keep a one-way hash of the email address, solely to stop the free trial being claimed repeatedly on the same address. It cannot be reversed to recover the address, and it is not used for any other purpose.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. To exercise any of these, email privacy@passkrypt.com; we respond within one month.

Portability is built in. You do not need to ask us. Export your entire vault to .vault, JSON or CSV from inside the app at any time — including after a trial or subscription has ended. Because your data is encrypted with keys we do not hold, exporting it yourself is the only way to obtain it in readable form.

You also have the right to lodge a complaint with your local supervisory authority.

Deleting your account

You can delete your account from my.passkrypt.com. Doing so permanently destroys your encrypted vault. Since we cannot decrypt it, we cannot recover it afterwards — export anything you want to keep first.

Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

Changes

If this policy changes materially we will email account holders before the change takes effect. The date at the top always reflects the current version.