Privacy Policy
Effective date: November 12, 2026. Operated by William Skipper.
1. Core Architectural Principle: Zero Plaintext Knowledge
tark-pass is engineered around a strict cryptographic principle: your master password, encryption keys, and decrypted vault contents never touch our servers. Cryptographic operations are executed client-side in your browser using the native W3C Web Crypto API before any transmission occurs.
2. What Data We Store on Our Servers
To provide synchronisation across your devices, our SQLite server database stores only:
- Your Username: Used strictly to identify your account and locate your cryptographic salt.
- Random Cryptographic Salt: A 256-bit cryptographically secure random value generated during registration, required for your client-side PBKDF2 key derivation.
- Authentication Key Verifier: A cryptographic hash (bcrypt) of your client-derived AuthKey, used solely to verify your login requests. The server never receives your master password or your VaultKey.
- Encrypted Vault Records: Opaque binary blobs containing AES-256-GCM ciphertexts, unique 96-bit initialization vectors (IVs), and 128-bit authentication tags. These cannot be decrypted without your locally derived VaultKey.
3. What We Never Collect or Process
We maintain an absolute zero-telemetry policy:
- No analytical beacons, trackers, or marketing scripts (e.g. Google Analytics, Mixpanel, or Meta Pixel).
- No error-monitoring telemetry that captures DOM state or user inputs.
- No third-party cookies or cross-site tracking identifiers.
- No selling, renting, or sharing of user records with any third party.
4. Network & Content Security Policy (CSP)
Our server enforces strict HTTP security headers, including default-src 'self', script-src 'self', and frame-ancestors 'none'. This technical configuration prohibits the browser from loading third-party scripts, stylesheets, or fonts, ensuring that your vault data cannot be exfiltrated to external origins.
5. Data Export & Account Deletion
You own your data completely. You may export your entire vault in decrypted CSV, JSON, or Netscape HTML formats at any time directly through the web vault interface. If you choose to delete records or delete your account, all associated database rows are permanently expunged immediately with zero shadow backups retained.
6. Contact & Questions
For privacy inquiries, technical audits, or data requests, contact the operator directly at contact@william-skipper.site.