Skip to content
An official-style zero-knowledge vault — your master password is never transmitted or stored.
Padlock

Privacy Policy

Last updated: August 30, 2026

Summary

Padlock is a zero-knowledge password manager. Your master password is created and verified entirely in your browser or extension — it is never transmitted to us, and we have no way to recover it. Every saved password and note is encrypted on your device before it is sent to our database. We never store your passwords in plain text on our servers — only ciphertext that we cannot read.

What we collect

  • Identity information from Google Sign-In (via Supabase Auth): your email address and Google account ID. Used only to identify your account.
  • Encrypted vault data: site names/URLs and usernames are stored as plain text (they are not secret); passwords, TOTP secrets, and secure notes are stored only as AES-256-GCM ciphertext we cannot decrypt.
  • A random salt and an encrypted “verifier”, used to check a returning master password locally without ever storing it.
  • Your preferences (theme, auto-lock timing, display settings).
  • Optional uninstall feedback: if you choose to tell us why you removed the browser extension, that reason/message is stored without being linked to your account.

What we never collect

  • Your master password — never transmitted, never stored, in any form.
  • Plaintext passwords, TOTP secrets, or note content — encrypted before leaving your device.
  • Browsing history. The extension only reads the current page to detect login forms when you actively use autofill or the save prompt.

Browser extension permissions

  • Host permissions (all sites) — required so autofill, the right-click fill menu, and the save-password prompt can work on any site you choose to use them on. The extension does not read or transmit page content except the specific form fields involved in an autofill/save action you initiate.
  • storage — keeps your session and cached vault key only in memory (cleared on browser close) or on your device.
  • identity — used solely for the Google Sign-In flow.
  • contextMenus — powers the right-click “Fill with Padlock” menu.
  • tabs — used to match the site you're on against your saved entries so the right ones are suggested.

Third parties

We use Supabase for authentication and database hosting, and Google for sign-in identity verification. We do not sell your data or share it with any other third party.

Your data, your control

You can export your entire vault (as CSV or JSON) at any time from the dashboard. To request deletion of your account and all associated data, contact us at the email below.

Contact

Questions about this policy: harshil23kachhadiya@gmail.com