Legal

Privacy Policy

Last updated: April 27, 2026 · Effective immediately

TL;DR — The short version

Your vault is encrypted on your device. We never see your passwords.
We don't collect, store, or sell your personal data.
The only data we receive is your email (for license delivery) and payment info (processed by our payment provider).
We don't use tracking pixels, fingerprinting, or behavioral analytics.

1. Who We Are

Hesych is a local-first password manager built and operated as an independent product. When this policy says "we," "us," or "our," it refers to Hesych and its sole operator.

For any privacy-related questions, contact us at [email protected].

2. What Data We Collect

We collect the absolute minimum necessary to operate the product.

Data you provide:

Email address. Collected when you purchase Premium, used solely to deliver your license key. We do not send marketing emails unless you explicitly opt in.
Payment information. Processed entirely by our payment provider (Gumroad). We never see or store your card details.

Data we do NOT collect:

Your passwords, usernames, or any vault content. Ever.
Your browsing history or behavior on other sites.
Device identifiers, IP addresses beyond what your browser sends in normal HTTP requests, or location data.

3. How Your Vault Data is Handled

      Your vault is encrypted with AES-256-GCM using a key derived from your master password via PBKDF2 with 600,000 iterations. The encrypted data is stored in your browser's IndexedDB, locally on your device. It never leaves your device unless you explicitly use the Cloud Sync feature.
    

This means even if our servers were compromised, there is no vault data to steal. We are zero-knowledge by architecture, not just by policy.

4. Cookies & Tracking

We do not use cookies for tracking or advertising. The only storage we use is:

localStorage. Stores your app preferences (theme, language) and license verification status. This data stays in your browser.
IndexedDB. Stores your encrypted vault. This data never leaves your device.

We do not use Google Analytics, Facebook Pixel, Hotjar, or any third-party analytics or tracking tools.

5. Third-Party Services

We use a minimal set of third-party services:

Gumroad. Payment processing. Subject to Gumroad's Privacy Policy.
Resend. Transactional email (license key delivery only). Subject to Resend's Privacy Policy.
Vercel. Hosting. May log standard HTTP request metadata (IP, user agent) for security purposes. Subject to Vercel's Privacy Policy.
Have I Been Pwned (HIBP). Breach checking. We send only a 5-character hash prefix of your password, never the full password. See HIBP's Privacy Policy.

6. Data Retention

We retain your email address for as long as your license is active, in order to provide support. You may request deletion at any time by emailing [email protected].

Your vault data is retained locally on your device. Uninstalling the app or clearing your browser data removes it permanently. We cannot recover it.

7. Your Rights

Depending on your location, you may have rights under GDPR, CCPA, or similar laws, including the right to access, correct, or delete your personal data. To exercise any of these rights, contact [email protected].

Because we collect minimal data, most requests can be fulfilled by simply clearing your browser storage and requesting email deletion from us.

8. Children's Privacy

Hesych is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy occasionally. Material changes will be communicated via the app or email. The "Last updated" date at the top of this page will always reflect the most recent revision.

10. Contact

Questions about this policy? Email us at [email protected]. We aim to respond within 48 hours.