Privacy policy

Who we are

Sifrvault is a product of Dogac Akdag (trade name), registered with the Dutch Chamber of Commerce (KvK) under number 98037498, located at Kastanjestraat 13, 3235 VG Rockanje, the Netherlands. For privacy questions: [email protected].

In short

• We have no servers with your data and no user accounts. The web access server only passes on encrypted messages that it can’t read.
• Your vault is encrypted on your device before it leaves your device. We don’t have the key.
• We use no analytics, ads or trackers, not in the app and not on this website.
• We only receive personal data if you email us: your email address and your message.

The data in your vault

What you store in Sifrvault (names, email addresses and usernames, passwords, websites, notes, folders, 2FA keys, recovery codes, passkeys, IBANs and PINs, SSH keys and documents such as scanned letters) is encrypted on your device with AES-256-GCM. The key is derived from your master password (PBKDF2-SHA256, 600,000 rounds). Your master password and the key never leave your device.

If you make a recovery key, the vault key is also encrypted with it and, like the rest of your vault, stored only in encrypted form in your iCloud. We don’t store the recovery key itself anywhere; it is only shown on your screen and in the emergency kit you keep yourself.

Because we have no access to your vault or your key, we don’t process this data as a controller and we cannot view, recover or hand it over.

Storage in your iCloud

The encrypted vault is synced through the private iCloud database (CloudKit) in your own Apple Account. Apple only stores encrypted data there. Apple’s terms and privacy policy, which you agreed with Apple, apply to this storage. We have no access to your iCloud account.

AutoFill

If you turn on AutoFill, Sifrvault tells your device’s operating system which websites you have a login or passkey for, with the matching username. That way your device can suggest Sifrvault on the right site. Passwords and the secret keys of passkeys are never passed on; Sifrvault only releases a password or passkey signature after you confirm with Face ID, Touch ID or your master password. This list stays on your device and disappears when you turn off AutoFill for Sifrvault.

Browser extension (Chrome, Edge, Brave)

The Sifrvault extension only works with the Sifrvault app on the same Mac. On the page you visit, it reads which fields are login fields and which domain the page has, so it can suggest matching logins. The extension stores no data, sends nothing over the internet and only talks to the app locally. The app checks the digital signature to make sure the request comes from the genuine Sifrvault helper.

When you sign in to a site, the extension checks whether the username and password you entered are already in your vault, and asks whether you want to save them if needed. For this, that data stays in the extension’s memory on your Mac for at most two minutes and only goes to the Sifrvault app; it is only stored in your vault when you click Save. A strong password suggested by the extension is created by the app on your Mac.

Web access (web.sifrvault.app)

Web access lets you use your passwords in a browser on another computer without installing anything there. The browser at web.sifrvault.app shows a QR code, which you scan with Sifrvault on your iPhone or iPad. Both sides create a new key pair for every session, and everything they exchange after that is end-to-end encrypted (ECDH P-256 and AES-256-GCM). The keys exist only in the memory of the browser tab and the app and disappear when the session ends.

Before anything is shared, your iPhone and the browser show the same six-digit check code, and you choose which logins the browser may see: all of them, only favorites or one folder. After Face ID, the browser sees only the name, username and website of those logins. A password or 2FA code is sent only after you approve that one item with Face ID again; the 2FA secret itself never leaves your iPhone. Documents, notes, passkeys and other vault data are never sent.

The web access server only passes encrypted messages between your browser and your iPhone. It can’t read them and doesn’t store or log them. To prevent abuse, it keeps your IP address in its working memory while you are connected. As with any website, the hosting server at IONOS records technical data such as your IP address, the time and which page was requested; this is deleted according to the hosting provider’s retention period. Your iPhone also tells the browser the kind of device (for example “iPhone”), so you know what you are connected to.

The web page itself stores nothing: no cookies, no local storage, and no third-party scripts or fonts. It clears a copied password from the clipboard after 30 seconds. A session ends after at most 15 minutes, after 5 minutes without activity, 2 minutes after you leave the tab, as soon as you close the Sifrvault app or send it to the background, and when you lock either side. A QR code is valid for 2 minutes and works once.

Only use web access on a computer you trust. Anything you show or copy in a browser can be read by malicious software on that computer or by someone watching a shared screen.

Face ID and Touch ID

Biometric recognition is handled entirely by Apple on your device. Sifrvault is only told whether recognition succeeded, never your face or fingerprint data.

Camera, photos and screen selection

Sifrvault only uses the camera when you ask it to: to scan a 2FA QR code or photograph a document. If you choose a photo or screenshot, or select part of your screen on the Mac (for example to read recovery codes or a QR code), that image is read on your device and then discarded. Only what you save, such as a scanned document, goes into your vault, encrypted. When you view a document, a decrypted copy sits temporarily in a protected folder on your device; it is erased as soon as you close the document or lock the vault.

If you make an export, you choose how. An encrypted backup is encrypted on your device with a password you choose (AES-256-GCM, PBKDF2-SHA256); without that password the file is unreadable, also to us. An unencrypted export (JSON), for example to switch to another app, contains your passwords and documents in readable form. You manage both files yourself; keep them safe and delete an unencrypted export as soon as you no longer need it.

Transferring to or from another app

If you transfer your data with the transfer feature of iOS or macOS, it goes encrypted through the system directly from one app to the other. It never passes through us. What you transfer to another app is then covered by that app’s terms and privacy policy.

Clipboard and screen sharing

If you copy a password, code or PIN, Sifrvault clears the clipboard again after a short time. On iPhone and iPad the copied item stays on that device only (not through Universal Clipboard to your other devices). The same applies on the Mac, where Sifrvault also marks the copied item as secret so clipboard managers don’t keep it in their history, and the clipboard is also cleared when you quit the app.

While a password, PIN or IBAN is visible on screen on the Mac, Sifrvault excludes that window from screen recordings and screen sharing, so it doesn’t accidentally end up in a recording or video call.

Analytics and crash reports

Sifrvault contains no third-party analytics or crash reporting. If you chose in your device settings to share analytics with app developers, Apple may show us anonymized crash reports. They contain no vault data. You can turn this off in Settings › Privacy & Security › Analytics & Improvements.

This website

This website uses no cookies, no analytics and no third-party fonts or scripts. For the website we work with IONOS and TransIP (hosting and domain name) and Cloudflare (security and speed). These parties process technically necessary data, such as your IP address and the time of your visit, to keep the site secure and available. We don’t use that data for any other purpose; it is deleted according to these parties’ retention periods. Cloudflare is an American company; transfers to the United States take place on the basis of the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.

When you contact us

If you send a question or suggestion from the app (Settings › Help), your own mail app opens a message to us. If you leave the switch on, it also includes the Sifrvault version and the type of device with its system version. Nothing from your vault is ever included, and the app itself sends nothing.

If you email us, we only use your email address and your message to answer your question. The legal basis is our legitimate interest in helping you. We keep the correspondence for up to twelve months after the last contact. Our email is hosted by Microsoft 365 (Microsoft Ireland Operations Ltd.), within the European Union.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and the right to object. Because we only process support emails, in practice this concerns those messages. Send your request to [email protected]; we respond within one month. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country.

Changes

If anything in this policy changes, we update the date at the top. For important changes we also let you know in the app.