Draft — to be reviewed by a lawyer before launch. This policy describes how Stashkey is designed to work. It may change before release.

Privacy policy

Effective date: 21 October 2026

Stashkey is a password and secret manager built so that we cannot read what you store in it. This page explains, in plain words, what we can see, what we keep, and what you can do about it.

The short version

Your vault is encrypted on your device. We only ever receive encrypted data.
Your master password never leaves your device, and we never store it.
We keep only what we need to run the service: your email address, encrypted data, and a few technical records.
No ads. No tracking. No third-party analytics. We do not sell data.

What we cannot see

Your vault contents. Passwords, notes, files, keys, passkeys, TOTP secrets, folder names and everything else inside your vault are encrypted before they reach us.
Your master password. It is used on your device to derive your encryption key. It is never sent to us or written down by us in any form.
Your recovery key. It is shown to you once at signup and is not kept by us.

Because of this, we cannot hand your vault contents to anyone, including if asked by a court, because we do not have the means to decrypt them.

What we store

If you use features that involve our servers (such as sync or sharing), we store:

Data	Why
Your email address	To identify your account and contact you about it, such as security notices.
Encrypted vault data	To sync your vault between your devices and keep version history. We cannot read it.
Wrapped sharing keys	To let shared folders work. These are folder keys encrypted for each member; we cannot unwrap them.
Your device list	So you can see which devices are signed in and remove one you no longer trust.
Subscription status	To know which plan you are on. Purchases are handled by Apple or Google; we use RevenueCat to receive the status of your subscription. We do not receive your card details.
Server logs	For security and keeping the service running, such as IP address, time and request type. Logs never contain vault data.

Features that do not involve our servers work on your device alone, and their data is not sent to us.

Breach checking (Have I Been Pwned)

The security check can tell you if a password appears in a known data breach. It uses the Have I Been Pwned service with a method called k-anonymity: your device hashes the password and sends only the first 5 characters of that hash. The service returns a list of matching hashes and your device checks the list locally. Neither Have I Been Pwned nor Stashkey learns the password.

No ads, no tracking

We do not show ads, use tracking pixels, or include third-party analytics or advertising SDKs in our apps or on this website. This website makes no requests to other domains and does not set cookies itself. Our network provider may set strictly necessary security cookies to protect the site from abuse.

Where your data lives

Our servers run on Amazon Web Services in the Mumbai region (ap-south-1), India. Traffic to our website and API passes through Cloudflare, which protects against attacks and may process technical data such as IP addresses to do so. Your vault data is encrypted end to end, so neither AWS nor Cloudflare can read it.

Who we share data with

We only use service providers needed to run Stashkey: Amazon Web Services (hosting), Cloudflare (network and security), RevenueCat (subscription status) and Apple or Google (app store payments). We do not sell or rent your data to anyone.

How long we keep data

Account and encrypted vault data: for as long as your account exists.
Version history: for the period your plan includes, then removed.
Server logs: for a limited time needed for security and troubleshooting, then deleted.
After you delete your account: your data is removed from our live systems promptly and from backups as they expire.

Deleting your account

You can delete your account from inside the app. This removes your email address, encrypted vault data, sharing keys and device list from our servers. Export your vault first if you want to keep it. If you cannot use the app, email us and we will help.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how it is used. Most of this you can do in the app. For anything else, contact us below. You may also complain to your local data protection authority.

Children

Stashkey is not directed at children under 13, and we do not knowingly collect their data.

Changes to this policy

If we change this policy in a meaningful way, we will update the effective date above and tell account holders by email before the change takes effect.

Contact

Questions about privacy: [email protected]