Privacy Policy

Last updated: 7 August 2026.

Summary

MyPwdTool is built so that there is as little of your data to protect, collect, or lose as possible. There is no MyPwdTool account, no analytics, no advertising, and no tracking of any kind. The sections below describe, precisely, everything the app does send over a network, and why.

Data stored on your device

Your vault — passwords, usernames, notes, card details, TOTP secrets, passkey metadata, and the local activity log — is stored only in an encrypted file on your own device. See Security & Encryption for exactly how it’s encrypted. This data is never uploaded to any server operated by MyPwdTool, because no such server exists.

Data sent to the sync relay (only if you enable sync)

If you turn on synchronization, encrypted messages pass through a relay server to reach your other devices. The relay stores and can only ever see:

• A random, pseudonymous device identifier and inbox identifier — not tied to your name, email, or any account
• The device name you (optionally) give each device — e.g. “Work MacBook” — stored in plain text (not encrypted), since it’s only ever used to label devices in your own paired-devices list. It’s never linked to an account (there isn’t one), but it is visible in plain text to anyone who could access the relay’s own database (i.e. nobody except the relay admin) — pick a name accordingly, the same way you would for a device name on any other Wifi network, Bluetooth service or online service.
• Opaque encrypted message blobs it cannot decrypt
• The minimum routing metadata needed to deliver a message to the right device, and to enforce abuse limits (message size and rate limits)

Full detail, including why the relay cannot decrypt this data even in principle, is in Synchronization. The relay’s source code is public at github.com/ThibaultDucray/e2eerelay.

Data sent to third-party services (only when you use the specific feature)

• Breach check: the first 5 characters of a SHA-1 hash of a password you’re checking are sent to the Have I Been Pwned API. Your password and its full hash are never sent — see Password Health & Breach Check.
• Website icons: when MyPwdTool shows a small icon next to an entry, it may request that icon from a favicon lookup service, sending only the domain name involved (e.g. “github.com”), never any account information.
• Purchases: subscription billing is handled entirely by Apple (App Store) or Google (Play Store) — MyPwdTool never sees or stores your payment details, and has no way to.
• Update check (Windows): the Windows app checks a static file on this website for the latest available version number. This request contains no personal data — it’s the same request your browser would make to load any web page.

What MyPwdTool never does

• No analytics or usage tracking of any kind
• No advertising, and no data sold or shared with advertisers
• No third-party SDKs bundled for tracking purposes
• No account system, so there is no email address or profile tied to your usage
• No server-side storage of your vault or any of its contents, encrypted or otherwise

Children’s privacy

MyPwdTool is not directed at children and does not knowingly collect data from them — the app collects essentially no personal data from anyone, as described above.

Changes to this policy

If this policy changes, the “Last updated” date at the top of this page will change accordingly. Material changes will also be reflected in the app’s release notes.

Contact

Questions, requests, or reports related to privacy: mypwdtool@tducray.fr