This policy explains how PasswordPal ("we", "us") handles personal information when you use PasswordPal (the website and service at passwordpal.net). We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Who we are
PasswordPal operates PasswordPal. You can contact us about privacy through our contact form (choose "Privacy request").
What we collect
| Information | Why |
|---|---|
| Account details — your email address and (optional) name. | To create and identify your account, let you log in, and send you important messages about it. |
| Encrypted vault data — your passwords, notes, folders and sharing keys, encrypted on your device. | To store and sync your vault. We cannot read it (see below). |
| Security data — a one-way hash used to check your login, an encrypted two-factor secret, hashed backup codes, passkey public keys, and login salts. | To authenticate you and protect your account. |
| Website domains — only if website icons are on: the domain names whose icons your browser asks us for. | To show website icons. Cached icons aren't linked to your account. |
| Activity logs — date and time, IP address, browser and device type for logins, failed attempts and important account changes. | To detect and prevent unauthorised access, show you your own activity log, and investigate problems. |
| Billing details — your plan, subscription status, and Stripe customer and subscription identifiers. | To provide paid plans. We never receive or store your card number; payments are processed by Stripe. |
| Family and team details — which families or teams you belong to, your role, and who invited you. | To provide shared collections and control who can access them. |
| Messages you send us — your name, email and message through the contact form or email. | To respond to you. |
We collect this information directly from you, or from your browser when you use the service. If someone invites you to a family or team, they give us your email address so we can send you the invitation.
What we can't see
PasswordPal uses end-to-end, zero-knowledge encryption. Your master password never leaves your device, and everything in your vault — including item names, usernames, websites, passwords, notes and folder names, and the names of family or team collections — is encrypted before it reaches us. We don't hold the keys, so we cannot read, search, sell, analyse or disclose the contents of your vault. How our encryption works.
How we use personal information
- To provide, maintain and secure the service, including logging in, syncing, sharing, families and teams.
- To send service emails: confirming your address, password resets, security alerts, invitations, and messages about your plan or trial.
- To process payments and manage subscriptions.
- To respond to your questions and requests.
- To detect, investigate and prevent fraud, abuse and security incidents, and to comply with the law.
We don't sell personal information, use it for advertising, or send marketing emails without your consent.
Who we share it with
We share personal information only with service providers who help us run PasswordPal, and only as much as they need:
- Stripe — payment processing for paid plans (your email and billing details you give Stripe).
- Our hosting provider — stores our servers and database (including your encrypted vault).
- Our email delivery provider — sends service emails to your address.
- Gravatar (Automattic) — if "Show Gravatar profile pictures" is on (it is by default, and you can turn it off in Account settings), your browser requests profile pictures from gravatar.com using a SHA-256 hash of the email address. Gravatar receives your IP address and that hash.
- DuckDuckGo's icon service — if "Show website icons" is on (default; can be turned off), our server asks DuckDuckGo for the icon of each website domain saved in your vault and caches it. DuckDuckGo sees only our server's request for the domain, never who you are. This does mean our server sees the website domains you store (for example "netflix.com") — never your usernames, passwords or notes.
- Have I Been Pwned — only if you run a breach check, your browser sends the first five characters of a SHA-1 hash of each password directly to the Pwned Passwords service. This can't be used to work out your passwords and isn't linked to your account.
Other people can see limited information when you choose to interact with them: someone you share an item with, or who shares with you, sees your name and email; members of your family or team see each other's names, emails and roles.
We may disclose information if required by Australian law, a court order or a lawful request from a government agency, or to protect the rights, safety or property of our users or others. Because your vault is encrypted, we can only ever provide it in encrypted form.
Overseas disclosure
Some of our service providers (such as Stripe and our email provider) may store or process information outside Australia, including in the United States. We take reasonable steps to ensure they protect it in a way consistent with the APPs.
Cookies and local storage
- One essential session cookie keeps you signed in and protects forms from forgery. It's deleted when you close your browser or log out.
- Your browser's local storage remembers your theme (light/dark), your email address if you tick "Remember email", and your password generator settings. These stay on your device.
We don't use advertising or third-party analytics cookies.
How we protect information
Beyond end-to-end encryption of your vault, we use HTTPS everywhere, strong password hashing (Argon2id), encrypted storage of two-factor secrets, rate limiting, strict browser security headers, access controls for our staff, and activity logging. No system is perfectly secure, so please use a strong, unique master password and turn on two-factor authentication or passkeys.
How long we keep it
- Account and vault data: while your account exists. When you delete your account, your account, vault and shares are deleted from our live database immediately. Copies may remain in encrypted backups for a limited time before they are overwritten.
- Activity logs: for as long as needed for security purposes; we periodically delete older logs.
- Billing records: as long as required by Australian tax law (usually 5 years). These are held mainly by Stripe.
- Contact messages: until your request is resolved and for a reasonable period afterwards.
Your choices and rights
- Access and correction: you can see and change your name in Account settings, and see your activity log at any time. You can ask us for the personal information we hold about you or to correct it.
- Export: download your vault any time under Import / export.
- Deletion: delete your account yourself under Account settings, or ask us to.
- Anonymity: you may use a name of your choice, but we need a working email address to provide the service.
We'll respond to requests within 30 days. We may need to verify your identity first.
PasswordPal and children
PasswordPal is intended for people aged 16 and over. Younger people may use it as part of a family plan managed by a parent or guardian.
Data breaches
If a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
Questions and complaints
Please contact us first through our contact form (choose "Privacy request"). We'll investigate and reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
We may update this policy from time to time. We'll change the date at the top, and for significant changes we'll let you know by email or in the app before they take effect.