Privacy Policy

1. Who We Are

Passa ("we", "our", "us") is a browser extension that stores and auto-fills passwords. All primary vault operations happen locally on your device.

2. What Data We Collect

Passa operates on a strict data-minimisation principle. We distinguish between data that stays on your device and data that may leave it.

Vault data stored only on your device or chosen sync provider:

• Your vault contents: passwords, usernames, URLs, secure notes, and TOTP secrets
• Your master password (never stored - used only transiently to derive encryption keys)
• Extension settings (auto-lock timeout, autofill preferences, sync provider choice)

Data you choose to sync via a third-party provider:

• If you enable Google Drive or Dropbox sync, your encrypted vault file is uploaded to your own account on that provider. We never have access to your provider account or to the file contents.
• To connect Google Drive or Dropbox, Passa uses OAuth. Our API may process OAuth authorization codes or refresh tokens only to complete or refresh the provider connection. We do not receive your provider password or decrypted vault.

Limited service data processed by Passa:

• Account sign-up and sign-in use your email address, a password-derived authentication verifier/hash, and key derivation settings. We do not receive your master password or decrypted vault.
• License checks use the email address and license information needed to confirm your plan and entitlement.
• If you subscribe to paid features, payment and billing details are handled by the payment provider. Passa receives the subscription or license status needed to unlock paid features.

Optional support data sent to Passa:

• If you submit a broken-site report, the extension shows the exact payload before sending it: the current site hostname, extension version, and selected failure type. It does not send the full URL, page contents, form values, usernames, or passwords.

Data we do not collect:

• Your plaintext passwords, master password, or vault encryption keys
• Your decrypted vault contents
• Telemetry, analytics, or usage statistics
• Automatic crash reports or background error logs
• Full page URLs, page contents, or browser history
• Browsing behaviour, except for a hostname you choose to submit in a broken-site report

3. How We Use Your Data

We use limited service data to create accounts, authenticate sign-ins, validate licenses, provide subscription entitlements, connect optional sync providers, protect against abuse, and prioritise compatibility fixes from user-submitted site reports. We do not sell personal data. We do not use vault contents for advertising, analytics, profiling, or any server-side processing.

4. Third-Party Cloud Providers

Sync features (Google Drive, Dropbox) are entirely optional. When enabled:

• You authenticate with the provider using OAuth - Passa never sees your provider password.
• Only your encrypted vault file is transferred. The encryption key never leaves your device.
• The provider's own privacy policy governs how they handle the file in your account.

5. Data Retention

Your vault data lives in your browser's local storage and, optionally, in your cloud provider account. You can delete all local data at any time via Settings → Privacy & Legal → Delete All My Data. To remove cloud copies, delete the file from your Google Drive or Dropbox account directly.

Limited service records are retained only as needed to provide the service, prevent abuse, comply with legal obligations, and resolve support requests. Contact us if you want to request deletion of account or support data held by Passa.

6. Your Rights (GDPR & CCPA)

Most vault-related rights are exercised directly on your own device because Passa cannot decrypt your vault. For limited service data held by Passa, contact us using the address below. We respect the following:

• Right to access - Export your vault at any time via Settings → Backup & Export.
• Right to deletion - Delete all local vault data via Settings → Privacy & Legal → Delete All My Data.
• Right to portability - Your exported vault is a standard JSON file you can use with compatible tools.
• Do Not Sell / Do Not Share - We do not sell or share personal data. This applies equally to California residents under CCPA / CPRA.

7. Children's Privacy

Passa is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children.

8. Security

Vault data is protected with AES-256-GCM encryption and keys derived via PBKDF2 with a high iteration count.

9. Changes to This Policy

If we make material changes we will update the "Effective date" at the top of this page and, where feasible, display an in-extension notice. Continued use of Passa after a change constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Email us at support@usepassa.com.