Security and privacy, as implemented.
This page describes what the current build does. It is written to be checked against the code, not to reassure.
Keys
- Master password → Argon2id → vault key wrap. The vault key never leaves your browser in clear.
- Changing the master password re-wraps the key; the data is not re-encrypted.
- A recovery code, generated once, can reset the master password. If both are lost, the vault is unrecoverable.
At rest
- The vault is an encrypted blob in your browser's storage, with a per-record encrypted shadow used for verification at unlock.
- The blob is authoritative. A damaged or altered shadow is detected and rebuilt from the blob; it cannot corrupt it.
In transit
- Sync is optional. Devices pair with a one-time code; the relay stores ciphertext envelopes and device identifiers.
- The server's health endpoint and access log carry no user data: method, path without query, status, duration, a 6-character device prefix.
Third parties
- The app loads the Geist typeface from Google Fonts; that is the only third-party request in the app, and it carries no vault data.
- No analytics, no advertising pixels, no session recording.
What is not yet true
- No independent security review has been completed. One is scheduled before the external beta; its findings will be published here.
- helloACT does not describe itself with security superlatives until the implementation and an independent reviewer support them.