Privacy policy

The short version#

• This website sets no cookies for visitors and uses no trackers, ads or third-party scripts.
• We count visits in an aggregated way: per day, how often each page was viewed, from which websites people arrived and from which countries. No IP addresses and no identifiers are stored.
• If you choose the 2Secret server (sync.2secret.app) in the app, we store your vaults. They are encrypted on your device: we can’t read what’s in them. We do store your e-mail address, your name and what’s needed to sync.
• If you don’t sync, or sync with your own server, we see nothing of your vault.
• The apps contain no analytics or tracking.
• If you contact us, we use your details only to reply, and delete your message after a fixed period.

Who is responsible#

The controller for this website and for the 2Secret server is J. v. Rekum. Questions about privacy: [email protected].

Visiting the website#

Statistics. For each day we store the number of views per page and language, the domain of the referring website (for example example.com, never the full address) and the country, as reported by Cloudflare. We don’t store IP addresses, user agents, cookies or any identifier, so we can’t recognise individual visitors. Visitors who send a Do Not Track or Global Privacy Control signal aren’t counted at all. We keep these totals for at most two years. The legal basis is our legitimate interest in understanding which pages are useful (Article 6(1)(f) GDPR).

Cloudflare. The website is delivered through Cloudflare, which protects it against attacks and makes it faster. Cloudflare necessarily processes your IP address to deliver the pages; it acts as our processor. Cloudflare may process data outside the European Economic Area; such transfers are covered by the EU–US Data Privacy Framework and standard contractual clauses.

Server logs. Our web server keeps technical logs for security and troubleshooting. IP addresses in these logs are shortened before they are written, and logs are deleted after 14 days.

Your preferences. If you switch between light and dark mode or dismiss the language suggestion, your browser remembers that choice locally (in localStorage). It is never sent to us.

Downloads#

Download links point to GitHub, where the files are published. When you download a file, GitHub processes your request under its own privacy statement.

Donations#

If this site shows a donate button, it is a plain link to PayPal: this site loads nothing from PayPal and sets no cookies for it. You donate on PayPal’s own website, under PayPal’s privacy statement. PayPal then shows us the amount and the name and e-mail address you donated with. We use them only for our records and to answer questions about your donation, we don’t share them, and we keep them no longer than our records require (Article 6(1)(f) GDPR).

Contact form and e-mail#

When you contact us, we process your name, e-mail address and message to answer you (Article 6(1)(f) GDPR). Messages are deleted automatically after 180 days. We don’t share them with anyone, except our e-mail provider, which delivers our replies.

The contact form can use Cloudflare Turnstile to keep out spam. If it is switched on, Turnstile checks your browser to tell people and bots apart; Cloudflare processes that data as our processor.

The 2Secret server (sync.2secret.app)#

The 2Secret server is a free sync service that we run ourselves, on our own server in the Netherlands. You only use it if you choose it in the app: when you create an account, sign in or connect to a server.

What we can’t see. Your vaults and everything in them (passwords, notes, attachments, passkeys, website icons and even the names and icons of your vaults), and your profile photo if you add one, are encrypted on your device before they go to the server. Your master password and Secret Key never leave your device. So we can’t read your vaults, and neither could anyone who stole our database. The same goes for what you share at a link and for the vault keys your device keeps ready for your emergency contacts.

What we do store.

• Your account: your e-mail address, the name you enter, a random account ID and the date you created the account.
• Key material: an authentication value derived from your master password and Secret Key (it lets us check that it’s you, but not work out your password), your encrypted keys and your public keys.
• Your vaults, encrypted, with what we can see about them: how many items they hold, how large those are, when they changed, and which accounts share a vault and in which role.
• Your devices: for each signed-in device a name (the computer name and operating system, your phone’s model or your browser’s name), when it signed in and when it last synced.
• Share links: for each link you make, its content, encrypted with a key that only the link holds; its title, encrypted so that only you can read it; when it expires, how often it can still be opened and whether it has a password.
• Emergency access: whom you chose as emergency contacts and who chose you, the waiting periods, when someone asked for access and whether they got it, and the vault keys for your contacts, encrypted for them.

If you share a vault, its members see each other’s name and e-mail address. You and your emergency contacts see each other’s name and e-mail address too.

IP addresses. To limit abuse, only a few new accounts can be created per IP address per day. For that, the server keeps your IP address (for IPv6, its /64 block) in memory for at most a day; it is never written to disk. Failed sign-ins are counted per account, also only in memory, for 15 minutes. Attempts to open share links are counted per IP address in the same way, for 15 minutes. The server’s logs contain no IP addresses and no e-mail addresses, only technical events, such as that an account with a certain ID was created or deleted.

Share links you receive. You don’t need an account to open a link someone shared with you. The page comes from the server itself, without cookies or third-party code, and decrypts what was shared in your browser. The server doesn’t record who opened a link; it only counts how often it was opened and how often a wrong password was tried.

Cloudflare. All traffic to sync.2secret.app passes through Cloudflare, which protects the server against attacks. To forward it to our server, Cloudflare decrypts the HTTPS connection, and so processes your IP address and what the app sends, such as your e-mail address when you sign in. Your vaults stay encrypted for Cloudflare too. Cloudflare is our processor; for transfers outside the EEA, the same applies as for the website.

Why, and on what basis. We process these data to sync your vaults between your devices, to share them with the people you choose, and to provide the share links and emergency access you set up (performance of a contract, Article 6(1)(b) GDPR), and to secure the service and prevent abuse (legitimate interest, Article 6(1)(f) GDPR). We don’t use them for anything else, we don’t sell them, and we share them with no one other than Cloudflare as described above. The server sends no e-mail.

How long.

• Your account and vaults: until you delete your server account. You do that yourself in the app, under Settings → Danger zone → Delete server account. Your account, your devices, the vaults you own, your share links and your emergency contacts are then removed from the server at once. Vaults that someone else shared with you stay with them.
• Signed-in devices: until you sign out, or after 30 days without use.
• Share links: until the link expires (at most 30 days), is opened for the last time or you revoke it, whichever comes first.
• Emergency contacts: until you or your contact remove them.
• Backups: we back up the database every night and keep each backup for 14 days, so deleted data is also gone from the backups within 14 days.
• The server’s logs: 14 days.

The 2Secret apps#

The apps are open source and contain no analytics, tracking or crash reporting. They only connect to:

• the server you choose, or to no server at all if your vault lives only on your device. If you run a 2Secret server yourself, or someone else runs one for you, whoever runs that server is responsible for the data on it;
• Have I Been Pwned, only when you click Check now in Watchtower. The app then sends only the first 5 characters of a hash of each password to api.pwnedpasswords.com, never the passwords themselves. Have I Been Pwned sees your IP address;
• GitHub, only if you turn on Updates in the settings. The app then fetches the list of new versions, and the update itself, from GitHub, which sees your IP address;
• the website of a login you save, to fetch its icon, unless you turn off Website icons in the settings. The app asks only that website, over HTTPS and without cookies; the website sees your IP address, as when you visit it. The icon is kept encrypted with the login.

You install the iOS app through Apple’s App Store; Apple processes the purchase and installation under its own privacy policy.

Your rights#

You have the right to access, correct and delete your personal data, to restrict or object to processing, and to data portability. You delete your server account yourself in the app, and you export your vaults yourself under Settings → Backup & export. For anything else, e-mail [email protected]. As we can’t read your vaults, we can only give you the data we can see ourselves. You may also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Changes#

If this policy changes, we’ll update this page and the date at the top.