Privacy Policy

Your vault, master password and every item exist only on your own devices, are never uploaded to our servers, and are technically inaccessible to us. This policy describes the very small amount of information we process to provide licensing and purchases.

1. What we never touch

• Your master password — it never leaves your device; we do not have it and cannot obtain it.
• Your vault data (accounts, passwords, card numbers, notes, attachments and so on) — stored encrypted locally, or synced to storage you choose (a local folder, iCloud Drive, your WebDAV server, your own cloud drive or object storage). We neither handle nor relay it. Only encrypted content leaves the device, and the storage provider cannot read it either.
• The storage credentials you enter for sync (cloud authorisations, WebDAV passwords and the like) — encrypted on your device alongside your vault, unreadable once the vault is locked, and equally untouched by us.
• Consequently, even if our servers were breached, none of your plaintext data could be exposed.

2. Information we process (licensing and purchases only)

• Activation email: used to deliver activation codes, manage licenses and send necessary transaction notices.
• Order details: product, amount, payment-channel order number and time, used for reconciliation and support. Payment is handled by Alipay; we neither receive nor store your bank card or payment-account credentials.
• Device identifier: an irreversible hash of a machine fingerprint generated at activation (not personally identifiable), used only to enforce per-plan device limits and to unbind or transfer devices.
• The activation code and its activation / revocation status.
• Error diagnostics (off by default; only sent if you turn it on in the app's settings, and you can turn it off anytime): when the app hits an unhandled error, it sends the device platform, OS version, app version, error type and code stack trace so we can fix it. It never includes vault contents, item names or your email address.

3. What we don't do

• No user profiling, no behavioural tracking, no advertising.
• We do not sell or share your information with third parties.
• The website uses no third-party tracking cookies; preferences such as theme are stored only in your browser.

4. Sharing

We share the minimum necessary information only in these cases: with the payment channel (Alipay) to complete a transaction; with the email provider to deliver license emails; or when required by law. Nothing else is disclosed.

5. Retention

License and order information is kept for the lifetime of your license and for any period required by law, after which it is deleted or anonymised.

6. Your rights

You can view, correct or delete the license information associated with your email, either yourself in License management or by contacting us. Deleting license data may make the related license unusable.

7. Browser extension

The RootKey browser extension stores and uploads nothing: it collects no browsing history, contains no analytics or tracking, and makes no external network requests. When filling, it only requests the matching credential for the current site from the RootKey desktop app running on your computer, uses it once and discards it — data never leaves your device.

8. Third-party SDKs

The app embeds the following third-party SDKs. Each runs only when you use the related feature:

• Alipay SDK (Alipay (China) Network Technology Co., Ltd.; Android only) — opens Alipay when you buy an activation code in the app. The SDK collects necessary device information (such as device identifiers, OS version and network / Wi-Fi status) for payment security and risk control; it does not access your vault. See the Alipay SDK privacy policy.
• Dropbox SDK (Dropbox, Inc.; iOS and Android) — only used to authorise RootKey when you choose Dropbox for sync. The resulting authorisation is stored encrypted in your vault; your vault itself is only ever uploaded encrypted. See the Dropbox privacy policy.

9. Contact

Privacy questions: hi@bitbeam.cn.