1. NO ACCOUNT, NO SERVERS
Pass Card has no sign-up and we run no servers or databases. We never receive your passwords, documents or anything else you store in the app.
2. WHAT IS STORED, AND HOW
Everything you save stays on your device:
- Passwords, notes, password history and generated passwords are encrypted with AES-256-GCM
- Personal documents and their photos are encrypted with AES-256-GCM under a separate key
- The encryption keys are kept in your device's secure storage (the iOS Keychain or the Android Keystore)
- Titles, usernames, website addresses, categories and settings are stored without encryption so you can search them
3. WHEN THE APP USES THE INTERNET
Your vault works without an internet connection. The app only goes online for these things:
- Website icons: to show a logo next to a saved login, the website's address (for example github.com) is sent to Google's icon service. Your username and password are never sent.
- Ads: the free version loads ads from Google AdMob (see section 7).
- Support, bug reports and ratings: when you send one of these forms, the name, subject and message you type are sent to us through Google Forms.
4. OPTIONAL iCLOUD SYNC (iOS ONLY)
If you turn on iCloud sync, an encrypted copy of your vault is saved in your own iCloud Drive:
- It is encrypted with AES-256-GCM using a key kept in your iCloud Keychain
- It is stored in YOUR iCloud account, not with us
- We cannot read it
- You can turn sync off at any time
5. BACKUP FILES
When you export a backup:
- The file is encrypted with AES-256-GCM using a password you choose
- Only someone who knows that password can open it, and we cannot recover a forgotten password
- The file is saved or shared wherever you choose; we never receive it
6. APP LOCK AND BIOMETRICS
You can lock the app with a 4-digit passcode and Face ID, Touch ID or fingerprint. Biometric data is handled entirely by your device's operating system; the app never sees or stores it.
7. ADVERTISING
The free version shows ads from Google AdMob. AdMob may collect device information such as the advertising ID and how you interact with ads, as described in Google's privacy policy. You can remove ads through an in-app purchase.
8. NO ANALYTICS OR TRACKING
We do not use analytics, crash reporting or tracking. We do not sell or share your data.
9. YOUR CONTROL
- You can export your data at any time
- You can delete any item in the app
- Uninstalling the app deletes all of its data from your device
10. CHILDREN
Pass Card is not directed at children.
11. CONTACT
For privacy questions or concerns, contact: henry.azer@outlook.com