Last updated: February 15, 2026
The short version: WARDKEY uses zero-knowledge vault encryption. We cannot read, access, or decrypt your vault data. Your master password never leaves your device. We collect the minimum data needed to provide our service. Optional AI features, when activated, send anonymized metadata (never passwords) to our servers for analysis.
WARDKEY ("we," "us," "our") operates the WARDKEY password manager application, browser extension, and related services (collectively, the "Service"). We are located at 444 Alaska Avenue, Suite #AHA780, Torrance, CA 90503, USA. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
For any privacy-related questions, contact us at: wardkey047@gmail.com
WARDKEY is built on a zero-knowledge vault encryption model. This means:
Note: Zero-knowledge vault encryption applies to your vault data. If you choose to use optional AI-enhanced features (Password Analyzer, Security Report, Phishing Detector), anonymized metadata about your vault is sent to our servers for analysis. See Section 12 for details.
| Data | Purpose | Required |
|---|---|---|
| Email address | Account creation, login, password reset, important service notifications | Yes (for cloud sync) |
| Name | Personalization | No |
| Password (hashed) | Authentication — stored as bcrypt hash, never in plaintext | Yes (for cloud sync) |
| Payment information | Pro plan billing (processed by third-party payment processor) | Only for Pro plan |
When cloud sync is enabled, your encrypted vault blob is stored on our servers. This blob is encrypted with AES-256-GCM using a key derived from your master password. We cannot read, access, or decrypt this data. The encrypted blob includes:
| Data | Purpose | Retention |
|---|---|---|
| IP address | Security, rate limiting, abuse prevention | 30 days |
| Device/browser type | Sync log, troubleshooting | 30 days |
| Sync timestamps | Conflict resolution, sync status | 90 days |
| Error logs | Debugging and service reliability | 30 days |
When you use the breach scanner, partial SHA-1 hashes of your passwords (the first 5 characters only) are sent to our server, which queries the Have I Been Pwned Pwned Passwords API using a k-anonymity model. Your full passwords or full hashes are never transmitted. The k-anonymity approach means neither our server nor HIBP can determine your actual passwords from the prefixes sent.
When you add an emergency contact, we send email notifications to the contact's email address on your behalf (invitation, access request notifications, approvals, and denials). The email addresses of your emergency contacts are stored on our servers to facilitate this feature.
When you create a share link, the encrypted credential data is stored on our server. The decryption key is embedded in the URL fragment (the part after the # symbol) and is never sent to our server. Only the recipient with the full URL can decrypt the shared data.
We use collected information solely to:
We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising or profiling.
We may share information only in these limited circumstances:
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion |
| Encrypted vault | Until account deletion or vault deletion |
| Sync logs | 90 days |
| Server logs (IP, errors) | 30 days |
| Payment records | As required by tax/financial regulations (typically 7 years) |
When you delete your account, your encrypted vault is permanently deleted immediately. Account metadata and related data are deleted within 30 days. Some information may be retained in encrypted backups for up to 90 days before being purged.
Depending on your jurisdiction, you have the following rights:
If you are in the EEA, you additionally have the right to:
Legal basis for processing: We process your data based on (a) contractual necessity (providing the Service), (b) legitimate interests (security, service improvement), and (c) your consent (optional features like cloud sync).
If you are a California resident, you have the right to:
To submit a verifiable consumer request, email wardkey047@gmail.com with the subject line "CCPA Request." We will verify your identity and respond within 45 days (extendable by an additional 45 days if needed). You may also designate an authorized agent to submit a request on your behalf — the agent must provide written authorization signed by you.
In the preceding 12 months, we have not sold any personal information. We do not use or disclose sensitive personal information for purposes other than providing the Service.
We respect privacy rights under all applicable laws, including but not limited to: LGPD (Brazil), PIPEDA (Canada), POPIA (South Africa), and the Australian Privacy Act. If you have jurisdiction-specific questions, contact us at wardkey047@gmail.com.
The WARDKEY browser extension:
chrome.storage.local (encrypted)chrome.storage.session and cleared when the browser closesactiveTab, storage, contextMenus, alarms, clipboardWrite<all_urls>) to detect login forms and offer autofill on any website you visit — the extension does not read page content or browsing historyWARDKEY is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at wardkey047@gmail.com.
Your encrypted vault data may be stored on servers located outside your country of residence. Where we transfer data internationally, we ensure appropriate safeguards are in place, including:
We use the following third-party services:
| Service | Purpose | Data Shared |
|---|---|---|
| Hosting provider | Server infrastructure | Encrypted vault blobs, account data |
| Payment processor | Pro plan billing | Payment information (never vault data) |
| Email service | Transactional emails (account verification, emergency access notifications) | Email address |
| Kit.com (ConvertKit) | Marketing email collection (landing page signup forms) | Email address, signup source |
| Anthropic (Claude AI) | AI-enhanced vault analysis (optional) | Anonymized vault metadata; raw text for Phishing Detector (see AI Analysis section) |
All third-party providers are bound by data processing agreements and are prohibited from using your data for any purpose other than providing their service to us.
When you use WARDKEY's AI-enhanced features, data is sent to our servers and processed using Anthropic's Claude AI. You can use WARDKEY without ever activating AI features — they are entirely optional.
| Data Sent to AI | Data Never Sent |
|---|---|
| Password length, character class distribution, strength score | Actual passwords, usernames, URLs |
| Number of vault items per category | Vault item names or contents |
| Reuse counts, age metrics | Any personally identifiable information |
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. For material changes that affect how we process your data based on consent, we will seek your explicit agreement before the changes take effect.
If you have questions about this Privacy Policy or wish to exercise your rights:
For GDPR-related inquiries, you may also contact your local data protection authority.