Privacy Policy
Secretomat — a password manager, as a browser extension and as a web app.
What Secretomat is
Secretomat is a zero-knowledge password manager: the server never sees anything you put in it. Passwords, notes and everything else are encrypted on your own device with a key derived from your master password. Only an encrypted container ever reaches the server, and the server cannot open it — it does not have the key.
This policy covers the browser extension (Chrome, Firefox) and the web app at app.secretomat.com.
What leaves your device
- Your e-mail address. It is the name of the account: you sign in with it, and the server uses it to tell whose data is whose.
- Encrypted containers. Your vault items, encrypted on your device. The server stores them as opaque blobs.
- A device label. A name you choose yourself when you add a device (“laptop”, say), so you can tell in the list which device to revoke.
- Timestamps and revision numbers. When something last changed, so that devices can synchronise and conflicts can be detected.
- The kind and version of the app (web, extension…), so the server can tell a version it no longer serves.
- The language of the account, in which we write you e-mails.
- Security records. For a sign-in or a failed attempt at one, a change of master password or keys, a revoked device, a change in sharing and emergency access, the server records the time, the kind of event and the IP address it came from. It deletes them after 90 days.
The server never receives your master password, nor the contents of your items in readable form. The master password never leaves your device; the server only gets a proof derived from it, from which the password cannot be recovered. The server's operational log contains no passwords, no item contents and no addresses of the pages you visit.
Sharing and one-time links
When you share a password or a folder with someone, they see your e-mail address and the check code, and get access only to what you shared with them. The content is encrypted for them and the server cannot read it; it does know who has access to what, so that it can enforce it. The same holds for groups and for a backup person.
A one-time link carries encrypted content that stays on the server only until it is opened or expires. Its key is only in the link itself; the server never receives it.
E-mails
Secretomat writes to you when your master password or recovery code changes, when someone signs in with the recovery code, and around emergency access. The e-mails carry no passwords and no item names. Resend sends them on our behalf; the server deletes its record of a sent e-mail after 30 days. An address that cannot be delivered to is remembered so that the server stops writing to it.
Site icons
Secretomat can show a site's icon next to a password. The web app and the extension in Firefox fetch it straight from that site, so the site sees a request for its icon from your IP address — nothing more, and nobody else does. The extension in Chrome takes icons from the browser and does not contact the site for them. Site icons can be turned off in Settings.
What stays on your device
- Keys live in the core's memory. After you unlock, the account key is held in the browser's session memory (
storage.session): it survives the extension going to sleep and is gone when the browser closes. Keys are never written to disk. - A cache of the encrypted containers in IndexedDB, so Secretomat works offline too. The data there is encrypted exactly as it is on the server.
- The offer to save a login after you submit a form waits in session memory only. Dismiss it, close the browser or let Secretomat lock, and it is gone — it never reaches the disk or the server.
- Your choice of server (if you run your own) in the extension's local storage.
The content script
To be able to offer autofill, Secretomat reads the login forms on the pages you visit: field types, their labels and attributes, the page address and its title. All of this happens on your device only. The page address is used to pick which of your logins are candidates for it — nothing about the pages you visit is sent to the server.
- A username and password are filled in only after you click a particular login, never on their own.
- A page is given a password only for the item you picked, and only for an address that belongs to it.
- Secretomat never fills in new passwords or one-time codes.
- When you submit a login form with a password Secretomat does not know, it offers to save it. You can decline.
The clipboard
A password you copy is wiped from the clipboard a minute later — but only if that password is still there. Whatever you copied in the meantime stays. To make that possible, Secretomat works with a digest (SHA-256) of the copied text, never with the text itself.
Permissions, and why Secretomat asks for them
storage- The cache of encrypted containers, the choice of server, and session memory for the key after you unlock.
alarms- Background synchronisation, locking after 15 minutes of inactivity, and wiping the clipboard after a minute.
activeTab- After you click the toolbar icon, Secretomat learns the address of the open tab, so it can offer the logins for that page.
clipboardRead,clipboardWrite,offscreen(Chrome only)- Copying a password and wiping it from the clipboard later. In Chrome the clipboard is read in a hidden extension document (
offscreen); in Firefox the extension's background page does it directly. - A content script on all sites (
http://*/*,https://*/*) - A login form can be on any page. Secretomat cannot know in advance which, so it needs access to all of them to recognise the form and offer to fill it. Page content is never sent anywhere.
favicon(Chrome only)- Site icons next to passwords, from the browser's own cache, without asking the site itself.
- Access to the server's address (
host_permissions) - Synchronising with the Secretomat server. If you choose your own server in the settings, Secretomat asks for access to that address at that moment, and only with your consent.
What Secretomat does not do
- No analytics, no traffic measurement, no tracking scripts.
- Your data is not sold or rented to anyone, and is handed only to the processors the service cannot run without (below).
- No use of your data for any purpose other than running the service you asked for.
- No creditworthiness assessment and no other profiling.
- No advertising.
Who helps us run the service
- Render (Render Services, Inc.) runs the server and the database in the European Union (Frankfurt).
- Resend (Resend, Inc.) sends e-mails from servers in the European Union (Ireland).
Each gets only what its work needs: Render the encrypted containers and the data above, Resend your e-mail address and the text of the e-mail.
Deleting your account
You can delete your account from within the app at any time. You can no longer sign in to it, and within 30 days everything belonging to it is removed from the server: the encrypted containers, the list of devices, and the account record with the e-mail address itself. A deleted password stays in the trash for 30 days and then disappears by itself; you can delete it from the trash at once. For a while the data may still sit in the database's daily backup, which rotates itself according to the provider's retention. You can also revoke a single device without closing the account.
Your rights
Processing of personal data follows the GDPR. You have the right of access to your data, to its rectification and erasure, to restriction of processing and to portability. In practice all your data is in the app, and you can delete it yourself or export it to a file at any time (Settings → Import and export); for anything else write to vaclav@matouch.cz.
Changes to this policy
If this policy changes, the effective date above changes with it. A material change to what leaves your device will be announced in the app before it takes effect.