Privacy Policy

The short version

Credensy is built so that we technically cannot read the contents of your vault — not your passwords, not your notes, not your keys. Everything inside your vault is encrypted on your device before it's ever sent to us, using a key that's derived from your master password and never leaves your device. We store and sync encrypted data; we do not, and cannot, decrypt it.

What we do collect

Outside your encrypted vault contents, we collect a limited set of account and device information:

• Your email address, used to identify your account.
• Cryptographic material needed to verify your identity and unwrap your vault key — a salted hash, never your actual password.
• Device metadata: a device identifier, name, platform, and the approximate IP-based location (country/city) of recent logins, used to show you your own device list and to flag logins from unfamiliar locations.
• Basic operational logs (timestamps, request outcomes) for security monitoring and abuse prevention.

What we never see

• Your master password.
• The contents of any vault item — logins, notes, keys, wallet seed phrases, or anything else you store.
• Your Recovery Key.

How we use what we collect

Account and device information is used solely to operate the service: authenticating you, syncing your encrypted vault across your devices, showing you your device list, and detecting suspicious account activity (like a login from a new location). We do not sell your information, and we do not run advertising or analytics tracking on this data.

Third parties

Location information is derived entirely from a local, offline IP-geolocation database we run ourselves — your IP address is never sent to a third-party geolocation service. The one optional exception in the product is the breach-check tool in Tools, which is opt-in and sends only the first 5 characters of a SHA-1 hash of a password you're checking to a third-party API — never the password or the full hash, and never anything from your saved vault items unless you explicitly paste it in to check.

Cookies

Signing in to the web app sets one strictly functional cookie used to recognize your browser as a known device — it carries no tracking payload and nothing is built from it beyond that. We don't use advertising or cross-site tracking cookies. See the Cookie Policy for the full detail.

The browser extension

The Credensy Chrome extension follows the same principles as the rest of the product, applied to what it can see on the pages you visit:

• It reads page content only to detect login form fields. Autofill only happens when you take an explicit action — clicking the icon next to a field, picking a saved login from the dropdown, or using the right-click menu. Nothing is filled automatically.
• When it offers to save or update a login you just typed, it sends only that site's URL, username, and password to Credensy's own API — and only after you explicitly confirm the save/update prompt. This data is never sent anywhere else.
• Generated passwords and authenticator (TOTP) codes are computed entirely on your device and are never transmitted anywhere.
• A password or code you copy from the extension is automatically cleared from your system clipboard a short time after copying.
• The extension requests permission to read and interact with any site you visit, because autofill and capture need to work on whatever site you're actually using — it does not use that access for anything beyond the login-detection and autofill features described above.

Data retention and deletion

Your encrypted vault data and account information are retained for as long as your account is active. Deleting your account removes your account record and vault data from our systems.

Contact

Questions about this policy can be sent to support@credensy.io.