mylockr Privacy Policy

Effective date: 22 October 2026

This policy explains what data the mylockr password manager handles and why. It covers the mylockr apps for macOS, Windows, iOS and Android, the mylockr browser extension for Chromium-based browsers (such as Chrome, Brave and Edge), Firefox and Safari (macOS and iOS), and the web pages at mylockr.web.app (together, "mylockr").

In short

• mylockr is zero-knowledge: your vault is encrypted on your device with a key derived from your master password and your Secret Key. Neither the developer nor Google can read your passwords, notes or any other vault content.
• mylockr does not ask for your name, email address or phone number. Your account is identified by a random-looking identifier derived from your Secret Key.
• mylockr contains no advertising, no analytics, no tracking and no crash reporting, and the developer does not sell or share your data.
• Encrypted vault data is synchronized through Google Firebase. Google, as a service provider, necessarily sees some technical metadata (for example IP addresses and when items change).
• Only on this device (optional, in the apps): if you choose "This device only" when you set up the app, no account is created and your vault is never sent to us or to Firebase. Nothing in "What is sent to Google Firebase" below applies to such a vault unless you later upload it to an account in Settings. If you choose a sync file for such a vault, the app reads and writes that file only when you ask; the file holds the same end-to-end encrypted data and is stored wherever you put it (for example iCloud Drive, Google Drive, Dropbox or OneDrive, under that provider's own terms). The app sends nothing to us for this and makes no network request of its own.

Who is responsible

The data controller is Mustafa Çörekci, an individual developer based in Turkey. Contact: mypasssecure37@gmail.com.

What stays on your device

• Your vault. Every device keeps a full, encrypted copy of your vault (in the apps, an encrypted database in the app's data folder; in the extension, an encrypted snapshot in the browser's extension storage).
• Your Secret Key and sign-in token. They are stored in the operating system's secure storage (Keychain on macOS and iOS, Credential Manager on Windows, a Keystore-protected file on Android). In the browser extension they are stored in the extension's local storage, which websites and other extensions cannot read.
• Biometric unlock (optional). If you turn on Face ID, Touch ID or fingerprint unlock, a vault key is kept in a device-only secure storage item that requires your current biometrics. On Windows, if you turn on Windows Hello, the vault key is kept in Credential Manager encrypted so that it can only be opened after a Windows Hello check (fingerprint, face or Windows Hello PIN), with a key that Windows keeps on the device (in its security chip where available). The biometric check is done by the operating system; mylockr never receives your fingerprint, face data or PIN. These items are not included in backups or synced to other devices.
• Browser extension unlock (optional, where available). If you enable unlocking the extension with a passkey (Touch ID) or with the mylockr desktop app, an encrypted copy of the vault key is kept in the extension's local storage or exchanged locally with the app on the same computer. Nothing about this leaves your computer.
• AutoFill (optional). On iOS and on macOS (macOS 14 or later), if you enable mylockr as an AutoFill provider (and turn on Face ID or Touch ID unlock), the app gives the system's AutoFill list only the website domain, the username and an item identifier of each login, so that the system can suggest them; passwords, notes and other fields are never written there, and the list is emptied when you turn off Face ID or Touch ID unlock. For a login with a two-factor (one-time) code, the list also holds a label (the service and account name) so that the system can offer the code; the code's secret is never written there. Payment cards are never written to the list: a card's details are inserted only when you pick the card. The mylockr AutoFill extension runs on your device, opens your vault only with Face ID or Touch ID, provides a password only for the login you pick, and has no network access (on macOS this is enforced by the system). On Android, the Autofill service only provides the login or card you select.
• Quick Access (desktop, optional). A keyboard shortcut opens a small mylockr search window over the app you are using, and the username and password you pick can be typed into that app (macOS and Windows) instead of being copied. On macOS this needs the Accessibility permission, which you grant in System Settings; mylockr uses it only to recognise the app, window and field in front (by identifiers and roles, never their content) and to type the login you chose, when you choose it. Typing does not use the clipboard. Quick Access settings (such as your list of remote desktop apps) are stored only on your device; nothing about Quick Access is sent anywhere. An optional diagnostic log for typing problems, off by default, stays on your device and contains no characters or field values.
• Exports. If you export your vault (an encrypted file or a plain-text CSV file), the file is written to your device. Keeping it safe is your responsibility; a CSV file is not encrypted.
• Password security report. The app can point out weak, reused and old passwords. This is worked out on your device, from your decrypted vault, while it is unlocked; nothing about it is stored on disk or sent anywhere (the optional breach check below sends only a short hash prefix). You can turn the report off in Settings.

The master password itself is never stored or sent anywhere.

What is sent to Google Firebase

mylockr synchronizes your vault through Google Firebase (Firebase Authentication and Cloud Firestore) in the Firebase project operated by the developer. The following is stored there for each account:

• Sign-in account (Firebase Authentication): a login identifier of the form <32 hexadecimal characters>@users.mypass.invalid, derived from your Secret Key. It is not your email address and cannot receive email. The sign-in password is a key derived from your master password and Secret Key (not your master password itself); Firebase stores it in hashed form. Firebase also assigns a user ID (the "account ID" shown in Settings) and records account creation and last sign-in times.
• Account profile (Cloud Firestore): encrypted key material (your vault key encrypted with a key derived from your master password, and an encrypted private key), a public key, the number of the key-derivation parameter set in use and a format version number.
• Vault items: for each item, a random identifier generated on your device, a revision number, the server time of the last change, a flag that marks deleted items, and the encrypted content. All item content (title, website addresses, username, password, notes and other fields) is inside the encrypted part.
• Vault manifest: one encrypted, authenticated record that lets your devices detect missing or rolled-back items.
• Secret Key renewal markers: if you renew your Secret Key (Settings), your sign-in identifier is changed to the one derived from the new Secret Key, and an empty marker whose name is derived from the old Secret Key is stored so that your other devices can tell that the key was renewed. The marker contains only a format version number and does not reveal the old sign-in identifier.
• File attachments: files you attach to an item are encrypted on your device and stored as encrypted pieces. File names, types and contents are inside the encrypted part; the server sees only the number and (rounded) size of the pieces and when they were stored. A storage counter records the total encrypted size of your attachments.
• Storage limit and invite codes: if your storage limit was raised, a record of the new limit (and of the invite code used, if any) is stored with your account ID. Invite codes record the account ID of the account that used them and when; the developer, who creates the codes, can see this.

Because the content is encrypted, Google and the developer can see only metadata: the number and size of encrypted records, when they were created, changed or deleted, and the IP addresses (and, for the browser extension, the browser's user agent) of the devices that connect. Firebase Authentication logs IP addresses and keeps them for a few weeks, according to Google.

The apps also read a small, non-personal settings document that controls how often devices synchronize.

If you set up mylockr with a different server (another Firebase project), that server's operator, not the developer, is responsible for the data stored there.

Desktop app updates

The mylockr desktop app is distributed through GitHub. To check for and download updates, the app contacts GitHub (github.com, objects.githubusercontent.com and release-assets.githubusercontent.com); downloading the app from the website works the same way. GitHub sees the IP address of the request and the app version; no account data, vault data or identifiers of yours are sent. GitHub processes this data under the GitHub Privacy Statement.

Breached password check (optional)

The mylockr app (macOS, Windows, iOS and Android) can check whether your saved passwords appear in known data breaches, using the Pwned Passwords service of Have I Been Pwned. This check is off by default; you turn it on in Settings › Password security, separately on each device. When it is on and you open the Security view (or choose "Check again"):

• the app computes the SHA-1 hash of each password on your device and sends only the first 5 characters of that hash to api.pwnedpasswords.com ("k-anonymity"); the service answers with every known hash that starts with them, padded with fake entries, and the app compares them on your device;
• your passwords, the rest of their hashes, your username, the website, your account ID or any other identifier are never sent; the request carries only a generic app name as user agent;
• the service necessarily sees the IP address of your device and when the requests are made. The answers are kept only in memory and are forgotten when the vault locks or you turn the check off.

The browser extension does not perform this check.

Camera

The camera is used only when you choose to scan a QR code: your recovery kit, the two-factor (authenticator) setup code a website shows, or an export from Google Authenticator. The image is processed on your device to read the code and is not stored or uploaded. On iOS this uses Apple's built-in frameworks. On Android, the code is read by Google's ML Kit barcode scanner provided by Google Play services; according to Google, ML Kit sends Google diagnostic and usage information (such as device model, operating system version, app package name and version, device and installation identifiers, and performance data), but not the camera images. See Google's ML Kit data disclosure.

Clipboard

mylockr writes to the clipboard only when you tap or click "Copy". Copied values are cleared automatically after 30 seconds and when the vault locks; where the operating system supports it, they are marked as sensitive or local-only so that they are excluded from clipboard history and from syncing to other devices. mylockr does not upload or keep clipboard contents. The browser extension cannot read the clipboard at all; the desktop app only checks whether the clipboard still holds the copied value before clearing it.

Browser extension and the websites you visit

• The extension only accesses a web page when you ask it to fill a login there (for example from the popup or with a keyboard shortcut), using the browser's "active tab" permission.
• If you turn on inline suggestions (off by default), the browser asks you to grant access to websites. The extension then shows a mylockr menu next to login fields and, when you submit a login form, offers to save or update that login. The captured username and password are kept only in memory for at most two minutes, are shown to you, and are saved to your encrypted vault only if you confirm. Sites you choose to "never save" are remembered in the extension's local storage.
• The extension does not record your browsing history and does not send website addresses or page content anywhere. Saved logins are encrypted before they are synchronized.
• The Firefox version works the same way. As Firefox requires, it declares that it transmits authentication information: your sign-in and your encrypted vault, sent only to the Firebase project described above.
• The Safari extension (macOS and iOS) works the same way and is part of the mylockr app.

Our website

The pages at mylockr.web.app (the home and download pages, the recovery-kit link page, the support page and this policy) are static pages served by Firebase Hosting. The former address mypass--4484.web.app redirects there; it still serves the recovery-kit link page and the files that link it to the apps (app association files), so links in older recovery kits keep working. The pages use no cookies, scripts from third parties or analytics. Download links lead to GitHub or the app stores, which see your request as described above. Firebase Hosting logs the IP addresses of requests and keeps them for a few months, according to Google. Your recovery kit's QR code contains your Secret Key after a "#" in the link; browsers never send that part to the server.

What we do not collect

mylockr does not collect your name, email address, phone number, contacts, location, photos, advertising identifier, browsing history, or usage analytics, and it does not include crash-reporting or advertising software. The developer does not sell, rent or share personal data, and does not use it for advertising or profiling.

Why we process data, and legal bases

Data is processed only to provide mylockr: creating your account, signing in, synchronizing your encrypted vault between your devices, delivering desktop app updates, and keeping the service secure and working.

• For users in the EU, EEA or UK (GDPR): processing is necessary to perform the contract with you, that is, to provide the service you asked for (Article 6(1)(b)). Technical logs kept by our providers to protect the service are based on legitimate interests (Article 6(1)(f)).
• For users in Turkey, see the Turkish version of this policy (KVKK disclosure).

Service providers and international transfers

The only service provider that processes your account and vault data is Google (Firebase), acting as a data processor under the Firebase Data Processing and Security Terms. Cloud Firestore data for this project is stored in Google's European multi-region (eur3). Firebase Authentication is operated from data centers in the United States, and Firebase Hosting is a global service. Google uses Standard Contractual Clauses and other safeguards for international transfers. See Firebase privacy information and the Google Privacy Policy.

GitHub (GitHub, Inc., United States) hosts the desktop app's downloads and update information and processes the IP addresses of those requests under its own privacy statement (see "Desktop app updates"); it receives no account or vault data.

Have I Been Pwned (operated by Troy Hunt, Australia, and delivered through Cloudflare's global network) receives the 5-character hash prefixes and the IP address of your device only if you turn on the optional breach check (see "Breached password check"); it receives no account or vault data.

App stores (Apple App Store, Google Play, Chrome Web Store, Firefox Add-ons) process data about your downloads under their own privacy policies; the developer receives only aggregated statistics from them.

Retention and deletion

• Your encrypted data stays on the server for as long as your account exists. mylockr does not currently delete inactive accounts automatically.
• Deleting your account: in the mylockr app go to Settings and choose to delete your account, or in the browser extension choose "Delete account…" in its settings (you will be asked for your master password and a written confirmation). This deletes your profile, all vault items, the manifest, any Secret Key renewal markers, your file attachments, storage counter and raised storage limit, and the sign-in account from Firebase, and the vault and keys on that device or in that browser. According to Google, deleted data is then removed from its live and backup systems within about 180 days.
• Other devices keep their local copy until you remove it there ("Remove from this device", in the extension "Remove from this browser"), or uninstall the app or extension.
• Deleting your account without the app: send an email from any address to mypasssecure37@gmail.com with your account ID, which the app shows in Settings (Sync) for synced vaults and the browser extension shows in its settings. Within 30 days we delete the sign-in account and all data stored for that account ID in Firebase (profile, vault items, manifest, renewal markers, attachments and storage records) and confirm by replying to your email. Your devices keep their local copies until you remove them there.
• Because we do not know who you are, we cannot verify that a request comes from the account's owner beyond the account ID itself: anyone who sends it can have the account deleted. The account ID is not a secret that unlocks anything (it cannot be used to sign in or to decrypt your vault), but treat it as private and share it only to request deletion.
• Log data kept by Google (IP addresses) is deleted on Google's schedule described above.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive it in a portable format. Most of these you can exercise directly in the app: export your vault, edit or delete items, and delete your account. For anything else, contact us. You also have the right to lodge a complaint with your data protection authority.

Security

Your vault is encrypted on your device with modern, published algorithms (Argon2id, HKDF-SHA256, XChaCha20-Poly1305) and a 128-bit Secret Key, and all connections to Firebase use HTTPS. Firebase security rules allow each account to access only its own data. Because only you hold your master password and Secret Key, lost credentials cannot be recovered by the developer. Keep your recovery kit safe.

Children

mylockr is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy. The current version is always available at mylockr.web.app/privacy with its effective date; we will point out significant changes in the release notes or in the app.

Contact

Questions or requests: mypasssecure37@gmail.com (Mustafa Çörekci). Help with the app: Support.

Türkçe: Gizlilik Politikası