The following policy narrates how we go about collecting, using as well as handling the user’s information when they operate our website, software, and services (“Services“).
Who we are
Our website address is: https://passhulk.com.
What & Why
First and foremost, We happen to collect and use the following information to provide our Services:
Account. This is done to ensure what we manage to collect and associate with the user’s account, information such as their name, email address, & payment information.
Services. Secondly, Our Services allow the customer to store their encrypted credentials and other sensitive data, collaborate with others, and work across multiple devices. To make that possible, we proceed to store, process and transmit the user’s encrypted data, messages, and other data as well as information related to it. This related information can be things like the individual’s profile nickname and profile image that make it easier to collaborate and connect with others. Our Services provide the user with different options for collaboration.
Usage. Moreover, We collect information related to the usage of our Services, including actions the user takes into their account. This helps with providing them with features like access logs and audit logs.
Not only this but We also happen to collect information from as well as about the devices they use to access the Services. This might include things such as the user’s IP addresses, the type of browser and device in their use, and identifiers associated with their devices. The user’s devices (depending on their settings) may also transmit location information to the Services.
Cookies and other technologies. In this case, We use technologies like cookies to provide, improve, protect and promote our Services. For instance, cookies help us with things like remembering the user’s username for their next visit, understanding how they are interacting with our Services, and improving them based on that information. The user can set up their browser to not accept cookies, but this may limit their ability to use the Services. Moreover, if our systems receive a do not track signal from the user’s browser, we’ll respond to that signal as outlined here.
With whom
We may be able to share information as discussed below, but we won’t be selling it to advertisers or other third parties.
Others working for PassHulk. PassHulk uses certain trusted third parties (for example, providers of payment processing services) to help us provide, improve, protect, and promote our Services. These third parties will access the user’s information only to perform tasks on our behalf in compliance with this Privacy Policy, and we’ll remain responsible for their handling of the user’s information per our instructions.
Other users. Our Services display information like their nickname, profile picture, to other users in places like their connection profile and sharing notifications.
Lawful Requests and other disclosures. We may disclose the user’s information to third parties if we determine that such disclosure is reasonably necessary to (a) comply with the law; (b) protect any person from death or serious bodily injury; (c) prevent fraud or abuse of PassHulk or our users; or (d) protect PassHulk’s property rights.
Stewardship of the user’s data is critical to us and a responsibility that we take seriously. Our users’ data should receive the same legal protections regardless of whether it’s stored on our servers or on their device. When responding to government requests (including national security requests) for our users’ data we will:
- Be transparent,
- Fight blanket requests,
- Protect all users and
- Provide trusted services.
Service Subprocessors
- Secure Email Service is used to provide account and service notifications
- Stripe is used to providing payment processing
How
Security. We have a very dedicated team to keep user information secure and for testing for active vulnerabilities. We also continue to work on features to keep the user information safe in addition to things like two-factor authentication, and client side encryption to prevent disclosure of their encrypted data. However no method of transmission over the Internet, or method of electronic storage, is 100% secure, the security of their Information also depends on how the user uses the Services and protects their login credentials and the Packing Key that enables them to access their account and decrypt their Encrypted Data.
Retention. We’ll retain the information the user stores on our Services for as long as we need it to provide them with the Services. If the user deletes their account, we’ll also delete this information. But please note the following term first :
(1) There might be some latency in deleting this information from our servers and backup storage
(2) We may retain this information if necessary to comply with our legal obligations, resolve disputes, or enforce our agreements. And the user can access their personal information by logging into their PassHulk account.
Where
To provide the user with the Services, we may store, process, and also transmit information in the United States and other locations around the world – including those outside their country. Information may also be stored locally on the devices they use to access the Services.
Your rights
If the users are in the European Economic Area (EEA), they shall have the following rights concerning information that PassHulk holds about them. PassHulk strives to provide the users with these rights no matter where they are located.
The user may exercise their rights to limit the use of their data by third parties, or receive a report of the data and usage of that data by contacting customer support at [email protected]. The user may also remove data not required by law for retention from our services by deleting their account.
Right to access: the user has the right to access the categories of personal information that we hold about them, including the information’s source, purpose, and period of processing.
Right to rectification: The user has the right to update the information we hold about them or to rectify any inaccuracies that were made. Based on the purpose for which we use their information, the user can instruct us to add supplemental information about them in our database.
Right to erasure: the user has the right to request that we delete their personal information in certain circumstances, such as when it is no longer necessary for the purpose for which it was originally collected.
Right to restriction of processing: the user may also have the right to request a restriction on the use of their information in certain circumstances, such as when the user has objected to our use of their data but we need to verify legitimate use or legal obligations to use it.
Right to data portability: the user has the right to transfer their information to a third party in a structured, commonly used, and machine-readable format if needed.
Right to object: The user has the right to object to the use of their information in certain circumstances, such as the use of their personal information for direct marketing purposes.
Right to complain: the user has the right to complain to the appropriate supervisory authority if they have any grievance against the way we collect, use, or share their information. This right may not be available to the user if there is no supervisory authority dealing with data protection in their country.
PassHulk browser extension
The PassHulk Password Manager extension for Chrome, Microsoft Edge and Firefox lets you use your PassHulk vault in your browser. It follows the same zero-knowledge model as the web vault: your vault is encrypted and decrypted on your device with keys made from your master password, and we only ever receive encrypted data.
What the extension handles, and why
- Your email address and a sign-in token, so you stay signed in to your PassHulk account. They are stored in your browser. You can see and end the extension’s sign-in at any time in the web vault under Settings → Active sessions.
- Your vault, downloaded from our servers in encrypted form. While the extension is unlocked, your vault key and logins are kept only in your browser’s temporary memory, which is cleared when the extension locks or the browser closes. They are never written to disk unencrypted.
- Website addresses. To find the logins saved for the page you’re on, the extension compares the page’s address with your saved logins on your device. Page addresses are not sent to us or anyone else.
- Sign-in forms. On web pages, the extension looks only for username, password and one-time-code fields, so it can fill your saved login and offer to save a new or changed one. It doesn’t read or collect any other content of the pages you visit. A login is only saved if you click “Save” or “Update”; it is then encrypted on your device before it is sent to us, like everything else in your vault.
- Passkeys. When a website offers to make a passkey and you click “Save”, the extension creates the passkey on your device and keeps it in your vault, encrypted like a password. When you sign in with it, the website only receives a signature, never the passkey’s private key. The extension only looks at a page’s passkey request when the website itself makes one.
- Settings, such as your auto-lock time and the sites where you turned automatic filling or saving off, are stored only in your browser. If you turn on PIN unlock, your PIN itself is never stored or sent: your browser keeps your vault key locked with a key made from your PIN together with a secret half that our server hands out only for the right PIN (after 5 wrong tries PIN unlock is switched off). Our server stores only a one-way check value of your PIN, never the PIN itself, and deletes it when you sign out.
What the extension doesn’t do
- It doesn’t contain advertising, analytics or tracking, and it doesn’t load code from the internet.
- It only communicates with our server (dashboard.passhulk.com) over an encrypted connection. It doesn’t send any data to third parties. Website icons are not fetched, so no third party learns which websites you’ve saved.
- We don’t sell or share data from the extension, and we use it only to provide the password manager.
Removing your data
Signing out of the extension removes your sign-in token and PIN from the browser; uninstalling the extension removes everything it stored there. Your vault itself stays in your PassHulk account until you delete the account (Settings → Delete account).
PassHulk iPhone and iPad app
The PassHulk Password Manager app for iPhone and iPad lets you use your PassHulk vault on your device. It follows the same zero-knowledge model as the web vault: your vault is encrypted and decrypted on your device with keys made from your master password, and we only ever receive encrypted data.
What the app handles, and why
- Your email address and a sign-in token, so you stay signed in to your PassHulk account. The token is stored in your device’s secure keychain. You can see and end the app’s sign-in at any time in the web vault under Settings → Active sessions.
- An encrypted copy of your vault, kept on your device so the app and AutoFill work without internet. It stays encrypted exactly as it is on our servers and can only be opened with your master password or Face ID / Touch ID.
- Face ID / Touch ID (optional). If you turn it on, your vault key is stored in your device’s secure keychain, available only on this device and only after Face ID or Touch ID confirms it’s you. Your face or fingerprint data is handled by Apple’s iOS and never reaches PassHulk or us.
- AutoFill (optional). If you turn on PassHulk in your device’s AutoFill settings, iOS shows PassHulk when you sign in to websites and apps. To suggest the right login, the app gives iOS the website addresses and usernames of your logins (never passwords); iOS keeps this list on your device. When you fill a login, the app sees which website or app is asking, only to show the matching logins; this isn’t sent to us or anyone else. The app remembers on your device which login you used in an app, so it can show it first next time.
- Copying. When you copy a password or code, it’s removed from the clipboard after 90 seconds and isn’t shared with your other Apple devices.
- Settings, such as your auto-lock time, are stored only on your device.
What the app doesn’t do
- It doesn’t contain advertising, analytics or tracking, and it doesn’t use your data to track you across other companies’ apps or websites.
- It only communicates with our server (dashboard.passhulk.com) over an encrypted connection. It doesn’t send any data to third parties.
- It doesn’t access your contacts, photos, location, camera or microphone.
- We don’t sell or share data from the app, and we use it only to provide the password manager.
Removing your data
Signing out of the app removes your sign-in token, the encrypted copy of your vault and the Face ID / Touch ID key from your device; deleting the app removes everything it stored there. Your vault itself stays in your PassHulk account until you delete the account (web vault → Settings → Delete account).
PassHulk Android app
The PassHulk Password Manager app for Android lets you use your PassHulk vault on your phone or tablet. It follows the same zero-knowledge model as the web vault: your vault is encrypted and decrypted on your device with keys made from your master password, and we only ever receive encrypted data.
What the app handles, and why
- Your email address and a sign-in token, so you stay signed in to your PassHulk account. The token is stored on your device, encrypted with a key held by Android’s secure key store. You can see and end the app’s sign-in at any time in the web vault under Settings → Active sessions.
- A random install identifier, sent when you sign in, so we can email you when your account is signed in on a device we haven’t seen before.
- An encrypted copy of your vault, kept on your device so the app and autofill work without internet. It stays encrypted exactly as it is on our servers and can only be opened with your master password or your fingerprint/face unlock.
- Fingerprint or face unlock (optional). If you turn it on, your vault key is stored on your device, encrypted with a key in Android’s secure key store that can only be used after a strong fingerprint or face check, and that stops working if a new fingerprint or face is added. Your fingerprint or face data is handled by Android and never reaches PassHulk or us.
- Autofill (optional). If you choose PassHulk as your device’s autofill service, Android asks PassHulk when you tap a sign-in field. To offer the right login, the app sees which website (in your browser) or which app is asking; this stays on your device and isn’t sent to us or anyone else. The app remembers on your device which login you picked for an app, so it can offer it first next time. Only the login you choose is filled.
- Copying. When you copy a password or code, it’s marked as sensitive and removed from the clipboard after 90 seconds.
- Breach check (optional). When you tap “Check for breaches” on the Vault health page, the app asks Have I Been Pwned’s “Pwned Passwords” service (api.pwnedpasswords.com) whether your passwords appear in known data leaks. For each password, only the first 5 characters of its SHA-1 hash are sent; the service answers with a padded list of matching hashes and the app compares them on your device. Your passwords, your email address and your vault never leave the device, and the result is only kept in the app’s memory until it locks.
- Passkeys (Android 14 and later, optional). If you turn PassHulk on as a passkey service, Android asks PassHulk when a website in your browser wants to make or use a passkey. The app sees which website is asking; this stays on your device. A new passkey is created on your device and kept in your vault, encrypted like a password, so it also works in the web vault, the browser extension and the iPhone app. When you sign in with it, the website only receives a signature, never the passkey’s private key.
- Recently generated. Passwords you copy or use from the generator are kept on your device for 24 hours (up to 10), encrypted with your vault key, in case you forgot to save one. You can clear the list at any time; signing out removes it.
- Settings, such as your auto-lock time, are stored only on your device.
What the app doesn’t do
- It doesn’t contain advertising, analytics or tracking, and it doesn’t use your data to track you across other companies’ apps or websites.
- It communicates with our server (dashboard.passhulk.com) over an encrypted connection. The only other address it contacts is the breach check below, and only when you ask for it.
- It doesn’t access your contacts, photos, files, location, camera or microphone, and it doesn’t use an accessibility service.
- App data isn’t included in Android’s cloud backups or device-to-device transfers.
- We don’t sell or share data from the app, and we use it only to provide the password manager.
Removing your data
Signing out of the app removes your sign-in token, the encrypted copy of your vault, the fingerprint/face key and the remembered app logins from your device; uninstalling the app removes everything it stored there. Your vault itself stays in your PassHulk account until you delete the account (web vault → Settings → Delete account).