Privacy Policy

What we collect, why we collect it, and how we handle your information

This policy is effective as of 28 October 2026.

On this page

Your privacy matters

This policy explains how Sycryptic handles personal information across our website and services.

  1. Information we collect

    We only ask for personal information when we truly need it to provide a service to you. We collect it by fair and lawful means, with your knowledge and consent, and we tell you why it is collected and how it will be used.

  2. Your vault data

    Vault entries such as passwords, secure notes, and recovery codes are encrypted in your browser before they reach us, under a key derived from your master password. That key is made in your browser and is never sent to us. You also sign in with your master password: we check it when you sign in and store only a hash of it, never the password itself. We only store ciphertext and keep nothing that can open it. Your master password does pass through our server when you sign in, so this protection also relies on that server running as described here.

  3. How long we keep data

    We keep your account and your vault for as long as you have an account, and we protect what we store within commercially acceptable means to prevent loss, theft, and unauthorized access, disclosure, copying, use, or modification. Items you delete stay in the trash for 30 days and are then deleted for good. Notifications are deleted 90 days after you read them, and after a year at the latest. We keep a record of the sign-ins to your account and the changes to its security, with the IP address and browser they came from, for one year, and you can see the last 90 days of it in your profile settings. An account whose email address is never verified is deleted after four days. When you delete your account, we delete it together with everything in your vault. Copies can remain in our encrypted backups for up to 30 days, until those backups are deleted.

  4. Sharing with third parties

    We share personal information only with the services we need to run Sycryptic, and when the law requires it:
    • XposedOrNot receives the email address of your account once a week, to check it against known data breaches. You can turn breach monitoring off in your profile settings.
    • Have I Been Pwned receives only the first five characters of a password's hash when password health checks it against known data breaches. Your passwords never leave your browser.
    • Microsoft delivers the emails we send you, such as verification links and security notifications.
    • Cloudflare carries the traffic to our website, including your IP address.
    • Backblaze stores our nightly backups, which are encrypted before they leave our servers.
    • Our hosting provider runs the servers that Sycryptic and its database run on.

  5. Your choices

    You are free to refuse our request for your personal information, with the understanding that we may be unable to provide you with some of your desired services. You can delete your account from profile settings when you no longer want to use Sycryptic.

  6. Questions

    If you have questions about how we handle user data and personal information, contact us at info@synetic.nl or visit our contact page.