Last updated: April 2026
UnveilPass is a zero-knowledge password manager operated by UnveilTech.
| Data | Purpose | Storage |
|---|---|---|
| Email address | Account identification, login, notifications | Encrypted at rest (AES-256-GCM) |
| Master password | Authentication | Never stored — only irreversible Argon2id hash |
The following data is encrypted in your browser BEFORE being sent to our server. We cannot read it:
| Data | Purpose | Retention |
|---|---|---|
| IP address | Security (rate limiting, audit log) | 90 days |
| Browser / User Agent | Device identification, audit log | 90 days |
| Approximate location (city/country) | Audit log, automatic dark mode | 90 days |
| Activity timestamps | Audit log (login, changes, sharing) | 90 days |
| Data | Purpose | Legal Basis (GDPR) |
|---|---|---|
| Authentication, notifications, breach alerts | Contract (account creation) | |
| Password hash | Authentication | Contract |
| Encrypted vault data | Service delivery | Contract |
| IP address | Security, rate limiting, abuse prevention | Legitimate interest |
| Audit log | Account security, compliance | Legitimate interest |
| Approximate location | Automatic dark mode, security | Legitimate interest |
We use the following third-party services. No vault data (passwords, entries, notes) is ever shared with third parties.
| Service | Location | Data Shared | Purpose |
|---|---|---|---|
| Stripe | USA | Email, payment information | Billing and subscription management |
| Have I Been Pwned (HIBP) | USA | First 5 characters of password SHA-1 hash only (k-anonymity) | Breach scanning — your actual password is never exposed |
| AI service provider | USA | Chat messages (only when you use the support assistant) | Optional in-app support assistant |
| MaxMind GeoIP | Local database | IP address (processed locally on our server, no external call) | Geolocation for audit log and dark mode |
| sunrise-sunset.org | External API | Approximate latitude/longitude derived from your IP | Calculate sunrise/sunset times for automatic dark mode |
| Data | Retention Period |
|---|---|
| Account data (email, vault) | Until you delete your account |
| Audit log (activity history) | 90 days |
| Deleted vault entries (trash) | 30 days, then permanently purged |
| SecureSend files | Until TTL expires (max 7 days), metadata kept 30 days |
| Web sessions | 60 minutes |
| Device trust tokens | 7 days |
| Email verification codes | 10 minutes |
Under the General Data Protection Regulation, you have the right to:
Residents of Virginia, Colorado, Connecticut, Utah, Montana and other states with privacy laws have similar rights. Contact us at support@unveiltech.com for any request.
Our servers are hosted by OVH in France (European Union). Your encrypted data is stored within the EU.
When we use third-party services based in the USA (Stripe, HIBP), only minimal non-vault data is shared (email hash for HIBP, email for Stripe billing). No vault data ever leaves our EU servers.
UnveilPass is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us at support@unveiltech.com for immediate deletion.
When you delete your account, ALL data is permanently and immediately removed:
This action is irreversible. No data can be recovered after deletion.
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice in the console. The "Last updated" date at the top indicates the latest revision.
For any questions about this Privacy Policy or your data: