The short version
- Your vault is end-to-end encrypted. Your logins, cards, notes and identities are encrypted on your phone with keys made from your passphrase and Secret Key. We never receive either, so we can't read your vault, and we can't hand it to anyone else in a readable form.
- We don't ask for your name or email to sign up. Your account is a random ID.
- No ads, no analytics, no tracking, no selling data. The app has no advertising, analytics or crash-reporting code.
- What we do hold is encrypted data, public keys, and records of sign-ins and device changes, needed to sync your vault and keep your account secure.
- Who we are
- What we can't see
- What we hold
- On your phone
- Other services
- This website
- How we use it
- Who we share with
- How long we keep it
- Your choices
- Contact
Who we are
BinaryIT Safe ("the app") is a password manager for Android made by Binary IT ("we", "us"), an Australian business. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy covers the app, the service it connects to, and this website, safe.binaryit.com.au.
What we can't see
Everything you put in your vault is encrypted on your phone before it is sent anywhere, with XChaCha20-Poly1305 and keys derived from two secrets only you hold:
- Your passphrase. It never leaves your phone. When you sign in, the app uses the OPAQUE protocol, so our server never receives your passphrase or anything it could use to guess it.
- Your Secret Key. A random key made on your phone, kept on your devices and your recovery kit. We never receive it.
So we can't see the titles, usernames, passwords, websites, card numbers, notes or other details of anything in your vault, or which sites and apps you have logins for. We also can't reset your passphrase or recover your vault if you lose both secrets.
What we hold
To sync your vault between your phones and keep your account secure, our server stores:
| What | What it is | Why |
|---|---|---|
| Account ID | A random identifier made by your phone. It isn't linked to your name or email. | To find your account |
| Your encrypted vault | Your items, their versions and deleted-item markers, all as ciphertext, padded so their sizes reveal little. Also the encrypted keys that open it. | To sync your vault and restore it on a new phone |
| Sign-in record | An OPAQUE record and the settings used to derive your keys. It can't be used to work out your passphrase without your Secret Key. | To let you sign in |
| Devices | For each phone: a random ID, its public keys, its name (encrypted), when it was added or removed, and the day it was last used. | To show you your devices and refuse ones you remove |
| Account log | A signed, hash-chained record of changes to your account, such as devices added or removed, with the times they happened. | So no one, including us, can change your account unnoticed |
| Security events | The kind of event (for example a sign-in, a failed sign-in, a passphrase change or a new device), the device, and the time. | Security and investigating abuse |
| Sessions | A one-way hash of each sign-in token, with when it expires (after 10 minutes). | To keep you signed in briefly |
| Rate-limit counters | Counts of recent requests, keyed by a secret-keyed hash of your network's address prefix (not your full IP address), your account ID or your session. | To slow down password guessing and abuse |
Network information. Like any internet service, our hosting provider sees the IP address your requests come from and may record it, along with your phone's model and Android version (sent in a standard request header), in short-lived operational logs. We don't store your IP address in our database.
Email addresses. We don't ask for one. If you choose to check an email address for data breaches, the app sends it through our server to Have I Been Pwned and shows you the result. We don't store the address or the result, and we don't use the address for anything else.
What stays on your phone
- An encrypted copy of your vault, so it opens quickly and works without a connection.
- Logins you choose to save while your vault is locked. They're encrypted with a key held in your phone's secure hardware and moved into your vault, then deleted, the next time you unlock.
- The app opts out of Android backup, so none of this is copied to your Google account.
Other services the app contacts
Some features talk to other services directly from your phone:
- Password breach checks (Have I Been Pwned, api.pwnedpasswords.com). The app sends only the first five characters of a one-way (SHA-1) hash of a password, and the match is made on your phone. The service can't tell which password, or whose, was checked. It sees your phone's IP address, as any website would.
- Breached-site checks (Have I Been Pwned, haveibeenpwned.com). The app downloads the public list of known breaches and compares it with your saved websites on your phone. Nothing about your vault is sent.
- Autofill inside apps. When you fill a web page shown inside another app, the app fetches that website's public
/.well-known/assetlinks.jsonfile to check the app is allowed to use the site's logins. That website sees a request from your phone. - Test builds only. Early-access test builds check email addresses with XposedOrNot (xposedornot.com) directly from your phone, only when you ask, instead of through our server.
Those services have their own privacy policies.
This website
safe.binaryit.com.au uses no cookies, analytics or tracking. It's hosted by Vercel, which receives your IP address and browser details when you visit and keeps them in its logs for a short time.
How we use information
Only to run BinaryIT Safe: to sync your vault, sign you in, show you your devices and account history, protect accounts from attack and abuse, answer your requests, and meet our legal obligations. We don't sell personal information, use it for advertising, or build profiles of you.
Who we share it with
- Supabase hosts our database and server code, in Sydney, Australia.
- Vercel hosts this website.
- Google distributes the app through Google Play, under Google's own privacy policy.
- Have I Been Pwned receives email addresses you ask us to check, as described above.
- Authorities, if the law requires it. We can only provide what we hold, described above. Your vault would be ciphertext we can't decrypt.
Your encrypted vault and account data are stored in Australia. Some of our providers are based overseas (Supabase and Vercel in the United States), and their staff or systems may access data from outside Australia to operate their services.
How long we keep it
- Your account, vault, devices, account log and security events: while your account exists, and deleted when you ask us to delete your account (see Delete your account).
- Deleted items: the encrypted last version stays in a trash for 30 days, then is deleted.
- Sessions: they expire after 10 minutes and are deleted a day later.
- Rate-limit counters: up to a day.
- Hosting providers' logs and backups expire on their own schedules.
Your choices and rights
- Access and correction. Everything in your vault is yours to view and change in the app. You can ask us for the other information we hold about your account, and we'll tell you what we can identify by your Account ID.
- Deletion. You can ask us to delete your account and everything we hold for it. See Delete your account.
- Optional features. Email breach checks happen only when you ask for them.
- Complaints. Contact us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
Beyond encryption, our server only accepts requests signed by a device on your account, refuses devices you've removed, and limits the rate of sign-in attempts. Your phones check what the server sends back, so a tampered or rolled-back vault is detected. No system is perfectly secure, but the design means a breach of our server would expose ciphertext and the metadata listed above, not your passwords.
Children
BinaryIT Safe is meant for adults. We don't knowingly collect information from children, and since we don't ask for names, ages or email addresses, we generally couldn't tell.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects what we collect or share, we'll tell you in the app before it takes effect.
Contact
Questions, requests or complaints: developer@binaryit.com.au. Please include your Account ID (from your recovery kit) if your question is about your account. Never send us your passphrase or Secret Key: we will never ask for them.