Your vault is encrypted on your phone. Not even we can read it.
PassFlow is built so you can store your passwords without having to trust us. This page explains, in plain words, what happens to your data.
How it works
- Your master password stays on your device
It is never sent anywhere. The app uses it to create, on your phone, the key that opens your vault (Argon2id).
- Your vault is encrypted before it leaves
Your passwords are encrypted with AES-256-GCM on your phone, before anything syncs.
- Our servers only receive encrypted data
We store your encrypted vault so your devices can sync. Without your key it is unreadable, including to us.
What we store
- Your email address and account ID
- Your vault, encrypted
- Your device models and last sync time
- Your subscription status
- Onboarding and plan screen usage, to improve the app
What we can't see
- Your passwords and notes
- Your master password
- Your recovery key
- The apps and websites where you use autofill
No ads, no tracking
PassFlow shows no ads, uses no advertising ID and sells no data. The app even removes the advertising permissions some libraries bring in.
Autofill happens on your device
To find login fields, Android shows PassFlow the structure of the screen. That is processed on your phone and never sent anywhere.
Where your data lives
Your account and encrypted vault are stored in Google Firebase, in the United States. Subscriptions run on RevenueCat. Payments go through Google Play, which never shares your card details with us.
If you forget your master password
Use the recovery key you created at sign-up. If you lose both, nobody can open your vault, not even us. That is the price of a vault only you can open.
If your subscription ends
Your vault becomes read-only: you can still view, copy and export your passwords. They are always yours.
Delete everything
In the app, go to Settings › Delete account. You can export your passwords first.
How deletion works →What we don't have yet
PassFlow has not had an independent security audit yet. It is on our roadmap, and we will share it here when it happens. PassFlow is made by Jose Campos, a developer in Brazil, as part of SkyzeCore.
Found a security issue?
Email the address below with the details and steps to reproduce. We read every report.
security@skyzecore.digital