Privacy Policy

Secret Manager is designed so we never see your master password or the contents of your vault.

What we store

• Email address and an SRP verifier (not your password).
• An encrypted vault blob we cannot decrypt.
• Item metadata you choose to index (title, type, URL) for search.
• Session tokens, security events, and optional billing records.

What we never receive

Your master password, derived keys, and decrypted item fields stay on your device.

Third parties

Email (Resend), payments (Stripe), and optional Have I Been Pwned checks are used only when configured. Local development skips them.