Your data stays on your Mac

The Apassy app

• Your vault is a file on your Mac, encrypted with your passphrase (SQLCipher). Apassy reads it only on this Mac.
• The vault leaves your Mac only when you choose it: a backup file that you save, or sync through a folder that you pick (iCloud Drive, Dropbox, and others) or through the Apassy relay. What goes there is the encrypted vault file. Nobody can read it without your passphrase.
• Apassy checks for updates: it reads https://apassy.wyderka.cc/latest.json after the start and then every 6 hours. Like any web request, it carries the IP address of your Mac. You can turn the check off in Settings.
• The bouncer model runs on your Mac. Agent commands and your rules are not sent anywhere.
• The iPhone companion talks to your Mac on your local network only.

The browser extension

The Apassy extension for Chromium browsers fills, saves, and creates website logins from the Apassy app on the same Mac. It has no servers and makes no network requests.

• What it reads. The address of the active tab, when you open the extension. The username and the password fields of the page, only when you click "Save this login". The extension does nothing on a page until you click its button.
• Where the data goes. Only to the Apassy app on the same Mac, through the browser's native messaging. Apassy asks for Touch ID or your passphrase before it fills a login, saves one, or creates one. It never sends the data to us or to anyone else.
• What it keeps. Nothing. It stores no data in the browser and never uses the clipboard. A password goes from the app into the page and is then dropped.
• How the data is used. Only to fill, save, and create logins in your Apassy vault. It is not sold, not given to third parties, not used for ads, and not used to decide credit or loans.
• Permissions. nativeMessaging to talk to the Apassy app, activeTabto read the address of the page that you are on after you click the button, and scripting to put the username and the password into the fields of that page.

This website

• The site and its downloads are served by Cloudflare. It sets no cookies and has no analytics or trackers.
• Cloudflare keeps the usual request logs (IP address, time, address, browser) to run and protect the site. We use them only for that.

Questions

Open an issue on GitHub. Report a security problem privately, as SECURITY.md says. The code of the app and the extension is public, so you can check each point above.