Privacy policy

1. How your vault is protected

Everything you keep in Passyble (logins, passwords, 2FA secrets, passkeys, notes, cards, identities, custom fields, tags and usage counts) is stored in one vault file that is encrypted on your device:

• Your master password is turned into a key on your device with Argon2id. That key wraps a random vault key, and every item is encrypted with the vault key using XChaCha20-Poly1305. Titles, website addresses and usernames are encrypted too.
• Your master password and your vault key are never sent anywhere. The few things the file keeps in clear text are what is needed to merge copies between devices: random item ids, change times, a random device id and deletion markers.
• Unlocking with Windows Hello or with your fingerprint or face on Android uses a key held by Windows or by the Android Keystore on that device. Passyble never receives your biometric data; Windows and Android handle it.
• An optional recovery code can unlock your vault if you forget your master password. Passyble shows it once and never stores it.
• Sensyble cannot reset your master password or recover your vault, because we never have either.

Passyble has not yet had an independent security audit.

2. What Sensyble receives

None of your data. Specifically:

• We do not run any server that the Passyble apps send your data to. There is no Sensyble account to create.
• The apps contain no analytics, telemetry, advertising or crash-reporting code that reports to Sensyble.
• Diagnostic logs (Windows) stay on your device. They never contain vault contents or secrets and are never sent automatically. If you choose to email us a log or a question, we receive what you send and use it only to answer you.

If you write to [email protected], we receive your email address and your message, use them only to reply, and delete them when they are no longer needed for that.

3. Passyble for Windows

Stored on your PC

• Vault files: the encrypted .vault file you created or chose (for example in a OneDrive, Dropbox or Syncthing folder). Vaults synced through Google Drive or Passyble Server are kept in %LOCALAPPDATA%\Pass\vaults.
• Settings: %APPDATA%\Pass\settings.json (your vault list, preferences, a random device id, the address and user name of a sync server, and the email address of a Google account used for Drive backup).
• Sync passwords and tokens: in Windows Credential Manager (a WebDAV password or Passyble Server device token, and a Google refresh token if you use Google Drive backup).
• Website icon cache: %LOCALAPPDATA%\Pass\icons, one small image per website, with file names made from a hash of the domain. Icons are not part of the vault and are never synced.
• Log file: %LOCALAPPDATA%\Pass\logs\pass.log, for start-up, browser connection, update and similar diagnostics. It never contains vault contents or secrets.
• 2FA step history: the last few outcomes per site (whether a site asked for a code), with hashed domain names, so Passyble stops showing code popups on sites that usually skip 2FA.

Copied passwords and codes are kept out of Windows clipboard history and cloud clipboard, and are cleared from the clipboard after 45 seconds.

Network connections

Update checks (GitHub)

With "Check for updates automatically" on (the default), the app asks GitHub for the latest release information about a minute after it starts and then once a day, and you can check by hand. The request is a plain download of a public file from github.com/sensyble/pass-releases. It contains no vault data, account or device id; like any web request, GitHub can see your IP address. If you choose to update, the installer is downloaded from GitHub and its signature is checked before it runs. Per-machine (MSI) installs do not check automatically. GitHub's own privacy statement applies to these requests.

Website icons (the websites themselves)

To show a site's own icon next to a login, the app makes an anonymous HTTPS request to that site's public home page and icon. The request carries only the site's host name: no cookies, no username, nothing else from the vault. The site, its hosting provider and anyone watching your network can still infer that you probably have a login there. Icons are fetched only while the vault is unlocked. Turn this off in Settings, Display, "Show website icons"; that also deletes the cached icons.

Breach check (Have I Been Pwned)

Only when you click "Check for breaches" in Password health. For each password, the app sends the first 5 characters of its SHA-1 hash to the Pwned Passwords service (api.pwnedpasswords.com) and compares the answer on your PC. Your password and its full hash never leave your PC. Nothing is sent automatically and nothing is stored.

Sync

Only if you set it up: the encrypted vault file is exchanged with the WebDAV server, Google Drive account or Passyble Server you chose. See Optional sync services.

Importing from another password manager reads the export file on your PC; nothing is uploaded. Export files are not encrypted unless you choose the encrypted export, so delete them when you are done.

4. Passyble for Android

Stored on your phone

• Vaults: the encrypted vault file in the app's private storage, or in a file you picked yourself (for example in a Syncthing folder).
• Settings and sync details: your vault list and preferences, a sync server's address and user name, a WebDAV password or Passyble Server device token (stored encrypted), and the email address of a Google account used for Drive backup.
• Locked list: if "Keep list visible when locked" is on (the default), a list of your items without any secrets (titles, usernames, websites, but no passwords, codes, notes, passkey keys or card numbers) is kept encrypted with a key from the Android Keystore, so autofill can show your logins before you unlock.
• Website icon cache and a short 2FA step history with hashed domain names, as on Windows.

Passyble opts out of Android's cloud backup and device-to-device transfer (allowBackup="false", with all data excluded), so your vault is not copied into Google's Android backup. Screens that can show a secret block screenshots and screen recording. Copied secrets are marked sensitive and cleared after 45 seconds.

Permissions and system features

Passyble does not use an accessibility service and does not ask for location, contacts, SMS, call logs, microphone, photos or files beyond the files you pick yourself.

Network connections

Website icons

The same as on Windows: an anonymous HTTPS request to the site carrying only its host name, while the vault is unlocked. Autofill never downloads icons. Turn it off in Settings, Display, "Show website icons", which also clears the cache.

Breach check

The same as on Windows: only when you start it, and only a 5-character hash prefix per password is sent to Have I Been Pwned.

Passkey check for apps (Digital Asset Links)

When another app on your phone asks Passyble for a passkey, Passyble downloads that website's public /.well-known/assetlinks.json file to confirm the app is allowed to use the site's passkeys. The request carries no vault data.

QR code scanning

The QR scanner decodes the camera picture on the phone with the open-source ZXing library, with no network connection. Camera images are not sent anywhere or saved, and the camera is only used while the scan screen is open.

Sync and Google Drive

Only if you set it up. See Optional sync services.

App updates come through Google Play. Google's privacy policy applies to Google Play itself.

5. Browser extension

The extension works together with Passyble for Windows. It talks only to the Passyble app on the same PC, through the browser's native messaging channel. The extension itself makes no requests to Sensyble or to any other server.

• Secrets: the desktop app decrypts a login and gives the extension one login at a time, only for the site it is saved for. The extension never stores passwords, codes or other secrets. A password you just typed into a sign-in form is held in memory only until you answer the "Save login?" prompt, and for a few minutes at most.
• What it stores (browser extension storage): your extension settings, the list of sites where you chose "Never for this site" (site addresses only), a record of whether it turned off the browser's own password saving, and whether you finished the setup guide. Two preferences ("Open suggestions automatically" and "Suggest strong passwords") are kept in the browser's sync storage, so if you use your browser's own sync, your browser provider syncs them to your other browsers. None of this is secret.
• Scan QR on this page: if you use it, the extension takes one screenshot of the visible tab and hands it to the desktop app on your PC, which reads the QR code there. It is not stored or sent anywhere else.

Permissions

On Firefox, the extension declares that it collects no data (data_collection_permissions: none).

6. Optional sync services

Passyble works without any sync. If you want your vault on more than one device, you choose where the encrypted file is kept. In every case that service receives only the encrypted vault file, which it cannot read without your master password.

WebDAV servers and cloud folders

You can sync with a WebDAV server you choose (for example your own Nextcloud), or keep the vault file in a folder that OneDrive, Dropbox or Syncthing syncs. That provider stores the encrypted file and sees what any storage service sees: your account with them, the file's size and change times, and your IP address. Their own privacy policies apply. Passyble connects over HTTPS; if you enter an address that starts with http:// for a server on your own network, the vault file stays end-to-end encrypted but the connection itself is not.

Google Drive backup

Where the app offers it, you can back up and sync a vault in your own Google Drive:

• Passyble asks Google only for the drive.appdata permission. It can then see and change only its own hidden app folder in your Drive, not your other files, and you can't see the folder in the Drive interface.
• Each vault is one encrypted file named after its random vault id. Google can see that the file exists, its size and change times, the random vault id and the vault's name (such as "Personal"), which is stored so that a new phone can list your vaults before you unlock one. Your items, titles, websites and secrets are inside the encrypted file. Signing in with Google does not replace your master password, and Google cannot decrypt the vault.
• Passyble reads your Google account's email address (from Drive) to show which account a vault is backed up to, and stores it on your device only.
• On Android, Google Play services handles the sign-in and the access tokens. On Windows, sign-in happens in your web browser, and the refresh token is kept in Windows Credential Manager on your PC. Neither is ever sent to Sensyble.
• Passyble uses the data it gets from Google only to store, sync and restore your vault file for you. It does not use it for advertising, does not sell it and does not transfer it to anyone. Passyble's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google's privacy policy applies to your Google account and Drive.

7. Passyble Server (self-hosted)

Passyble Server is software that you, your employer or someone you trust runs on their own computer or server. Sensyble does not run Passyble Server for anyone and has no access to any Passyble Server or its data. The person or organization who runs the server is responsible for it and for any information it holds.

A Passyble Server stores:

• the encrypted vault files, earlier versions of them for a limited time, and backups if the operator sets them up;
• your account name, your email address if the operator or you added one, a value derived from your password that lets the server check a sign-in (never the password itself, and it cannot unlock the vault), and optional two-factor sign-in settings;
• the devices you signed in with (their names, such as your phone model, and a hashed token per device);
• a security log of sign-ins, failed attempts and account changes, with IP addresses and device names, which you can see for your own account in the apps.

If email is set up, the server sends invites, password reset links and security notices through the operator's email provider. The server never receives your master password or vault key and cannot decrypt your vault.

8. Services Passyble may contact

All of these connections use HTTPS, except a WebDAV or Passyble Server address on your own network that you set up with http://.

9. Google Play data safety summary

10. Deleting your data

Sensyble holds none of your Passyble data, so there is nothing to ask us to delete. Everything is on your devices and in the sync storage you chose. Step-by-step instructions for each platform are on the Delete your data page. In short:

• Single items: Delete moves an item to the trash. It is removed for good after 30 days, or right away when you delete it from the trash or empty the trash. The deletion syncs to your other devices.
• Android: remove the vault from the list (a vault that exists only on the phone asks you to confirm permanent deletion), or uninstall the app, which deletes all of its data on the phone.
• Windows: remove the vault from the list, then delete its .vault file. When uninstalling, tick "Delete the application data" to remove settings and caches; vault files are kept even then, so delete them yourself.
• Browser extension: remove the extension; the browser deletes its stored settings.
• Google Drive: in the app, Settings, Sync, turn off Google Drive backup and choose to also delete the copy on Google Drive. You can also delete Passyble's hidden app data in Google Drive's settings under "Manage apps", and remove Passyble's access in your Google Account's security settings.
• Passyble Server: the server's operator deletes your account and its files. Sensyble has no access to it.
• WebDAV or cloud folders: delete the vault file there. Version history or backups kept by those services may hold older encrypted copies until they expire.

11. Children

Passyble is not directed to children under 13, and we do not knowingly collect personal information from children. Because Passyble sends no user data to Sensyble, we do not collect such information from anyone. If you believe a child has sent us personal information by email, write to us and we will delete it.

12. Your rights

Depending on where you live, you may have rights to access, correct, delete or move personal data held about you. Sensyble does not hold your Passyble data, so you exercise these rights directly in the apps and with the sync services you use (for a Passyble Server, with its operator). For anything you have emailed us, contact [email protected].

13. Changes to this policy

If Passyble starts handling data differently, we will update this page before the change ships and change the effective date at the top. If a change means data reaches Sensyble or a new third party, we will also say so in the app or its release notes.

14. Contact

Sensyble, www.sensyble.net
Email: [email protected]