Privacy Protocol

1. Cryptographic Isolation Guarantee

At PassCrypt, privacy is not a policy; it is a mathematical invariant. We operate a zero-knowledge architecture. All encryption and key derivations happen entirely within your local browser sandbox utilizing the compiled WebCrypto API. Your Master Password and Data Encryption Keys (DEK) are never transmitted, viewed, or cached on our network lines under any circumstances.

2. Raw Information Collected

We do not collect personal metadata, IP analytics, or track browser activities. The database stores only the minimal schema required to operate your sandbox synchronization:

• Hashed Auth Keys (used solely for login authentication)
• Your account email address (used for credential logging and status validation)
• Client-side encrypted Vault records (AES-256-GCM base64 format)
• Client-side encrypted Data Encryption Key (DEK)
• Hashed 2FA verification states

3. Sandbox Storage and Memory Invariants

When you initiate a vault unlock sequence, the local Master Key decodes the Data Encryption Key. The DEK is held exclusively in the browser's volatile SessionStorage. It is designed to automatically wipe and zero-out on:

• Browser tab termination
• Configurable idle timeout (defaulting to 15 minutes)
• Manual system locking

4. Third-Party Disclosures & Compliance

We do not distribute, sell, or license vault metadata. Because we do not hold the cryptographic keys to decode your vault, we cannot disclose decrypted data to government authorities or third-party auditors. Even in the event of an infrastructure breach, the adversary obtains only high-entropy ciphertext blocks which are mathematically unreadable.

5. Sovereign Portability Rights

You retain complete sovereignty over your keys. You can execute a local vault export at any time. The exporter downloads your data as a decrypted JSON or CSV file onto your physical storage drive. We impose no export bounds or vendor locks.