Privacy Policy
PassFlow is a password manager for Android, published by Jose Campos ("we"). This policy explains what the app collects, why, and what you can do about it. Questions: josegcampos2023@gmail.com.
The short version. Your passwords are encrypted on your phone with a key made from your master password before they are synced. We store only that encrypted data and cannot read it. We don't show ads, we don't sell data, and we don't use an advertising ID.
What we collect and why
| Data | Why |
|---|---|
| Account: your email address and an account ID. If you sign in with Google, also the name and profile picture Google shares. | So your devices can find your vault, and to contact you about your account. |
| Your vault: logins, notes and their history, encrypted on your device. Also the settings needed to unlock it (a random salt, key-derivation parameters and your vault key, itself encrypted). | To sync your vault between your devices. We can't decrypt any of it. |
| Devices: each device's manufacturer and model, and when it last synced. | To show you which devices use your vault. |
| Subscription: your plan, trial and renewal status, and purchase history, linked to your account ID. Payment details stay with Google Play. | To know whether your subscription is active. |
| App usage: which onboarding screens you saw, your answers to the onboarding questions, paywall views, trial starts and purchase errors, plus device model, OS version, app version, approximate region and an app instance ID. | To understand and improve the onboarding and the app. Never used for advertising. |
Your master password never leaves your device. For email accounts, the app derives a separate value from it to sign you in. That value can't be turned back into your master password and can't decrypt your vault.
Autofill. When you use PassFlow as your autofill service, Android shows PassFlow the structure of the screen you're filling (field types, the app's package name, the website's domain) so it can find login fields and suggest the right login. This happens on your device and isn't sent anywhere. To show "Unlock PassFlow" only where you have a saved login, the app keeps a list of keyed hashes of your saved domains and app names on the device, not the names themselves.
Who processes your data
- Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Google Analytics for Firebase): account, encrypted vault, devices, account deletion requests and app usage. Vault data is stored in the United States.
- RevenueCat: subscription status and purchase history, linked to your account ID.
- Google Play: payments and subscription management, under Google's own privacy policy.
We don't sell or share your data with anyone else, and we don't use it for advertising.
How long we keep it
Account, vault and device data stay until you delete your account. App usage events are kept for a limited period set in Google Analytics (2 months by default). Purchase records may be kept longer where accounting or tax law requires.
Deleting your account and data
You can request deletion in the app from Settings › Delete account. You can export your passwords first. The app asks you to confirm with your master password and sign in again. Once the server confirms your request, access to your account is blocked and deletion of your account, encrypted vault, history and device list continues on the server even if you close the app. An offline phone learns about deletion when it reconnects.
After server deletion completes, we temporarily retain a private record containing your account ID and deletion timestamps, with no passwords, vault keys or email address. This prevents old sign-in tokens from recreating deleted data. It is scheduled for automatic removal after 24 hours; processing may take additional time.
Email josegcampos2023@gmail.com from the address on your account, with the subject "Delete my PassFlow account". We will delete your account, your encrypted vault and its history, and your device list within 30 days, and confirm by email. Purchase records kept by Google Play and RevenueCat follow their own retention. Before deleting, you can export your passwords from the app (Settings › Export all passwords).
Deleting your account does not cancel your Google Play subscription. Cancel it in Google Play to stop future charges.
Security
Your vault is encrypted with AES-256-GCM under a random vault key, and that key is itself encrypted with a key derived from your master password using Argon2id. Because we can't read your vault, we can't recover it if you lose both your master password and your recovery key.
Children
PassFlow isn't directed at children under 13, and we don't knowingly collect their data.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to its processing. Email us and we'll answer within 30 days.
Changes
If this policy changes, we'll update the date at the top and, for significant changes, tell you in the app.