Privacy
Back
Last updated 15 October 2026. Short version: your vault is encrypted on your device, and we cannot read it.
Secret keys, service and account names, folders, tags and notes are encrypted on your device (AES-256-GCM) before they sync. The server stores that ciphertext and your vault key wrapped by a key only your master password produces. Your master password never leaves your device; a separate sign-in password derived from it is what the server checks.
Your email address and sign-in records; how many records your vault has, their sizes and when they changed; for Trash, version history and nightly backups, the same encrypted records kept for longer. Each device that syncs is listed with a random id made on that device, a name like "Web browser", and when it was last used, so your plan can count devices and you can remove one. Network requests reveal your IP address to the server and its host.
Paid plans are processed by Flutterwave. We store the plan, its period, the currency and the payment reference; card and bank details go to Flutterwave and never reach our server. Flutterwave's own privacy policy covers what they keep.
The app keeps an encrypted copy of the vault and your preferences on each device. Unlocked accounts live in memory and are wiped when the vault locks. Passkey or fingerprint unlock stores the vault key only wrapped by a key your device releases.
There are no advertising or tracking analytics, and nothing is sold or shared for marketing.
Storage keeps the encrypted copy and settings. Active tab and scripting fill a code into the page you are on, when you ask. Host access lets the extension reach the Authenticator server. It does not read pages in the background.
Export an encrypted backup at any time. Signing out removes the copy from that device; removing a device from your plan stops it syncing. Deleting an account from inside the app is not available yet; until it is, ask SigmaDev to delete it and your records are removed from the server, with nightly backups ageing out within 30 days.