Privacy Policy

1. Executive Overview and Zero-Knowledge Architecture

XG8 Password Keeper ("the Application", "the Service") is developed and operated by XG8, an independent digital studio registered in the Netherlands (Chamber of Commerce / KvK: 42148116). The Service is engineered under an uncompromising Zero-Knowledge cryptographic principle. The foundational design objective is that no entity—including the developers, hosting providers, Google Play, or database administrators—can access, view, or decrypt your stored credentials, private notes, or authentication secrets.

All encryption and decryption operations take place exclusively on your local client device (browser runtime or native mobile application). Your Master Password is never transmitted over any network in plaintext, and the derived cryptographic keys never leave your local hardware environment.

2. Cryptographic Specifications and Local Encryption

To guarantee confidentiality and integrity, XG8 Password Keeper implements verified, peer-reviewed cryptographic primitives:

• Key Derivation: Master Passwords undergo key derivation via Argon2id (or PBKDF2-HMAC-SHA256 with 600,000 rounds and HKDF-Expand) utilizing unique cryptographic salts generated client-side, mitigating brute-force and hardware-accelerated dictionary attacks.
• Vault Item Encryption: All sensitive records, usernames, passwords, two-factor authentication (TOTP) seed secrets, and notes are encrypted locally using AES-256-GCM (Advanced Encryption Standard in Galois/Counter Mode with 256-bit keys and 128-bit authentication tags).
• Authenticated Nonces: Every stored record is encrypted with a unique 96-bit cryptographic nonce to prevent replay attacks and cryptographic pattern analysis.

3. Server-Side Data Ingestion and Storage

For users opting into optional cloud synchronization, backend infrastructure only receives, persists, and transmits opaque cryptographic artifacts:

• User account identifier and email address (for authentication and critical security events).
• Client-side cryptographic salt (Base64-encoded) for key derivation consistency.
• Password verification hash (computed from the derived key, preventing the server from deriving the underlying Master Password).
• Encrypted vault payloads consisting exclusively of AES-256-GCM ciphertext, nonces, and authentication tags.

In the event of an infrastructure compromise or unauthorized database access, all vault contents remain mathematically unreadable and completely protected by AES-256-GCM encryption.

4. Mobile Application Permissions & Android Autofill Service

The Android release of XG8 Password Keeper incorporates the native AutofillService framework to detect credential input fields and securely provide account credentials upon user authorization:

• Zero Keylogging & Screen Reading: The Service does not monitor general user keystrokes, clipboard history, or screen contents outside the immediate OS autofill prompt boundaries.
• Transient Memory Architecture (Pending Saves): If a user prompts the Application to save new login credentials while the vault is in a locked state, the captured credentials are held strictly within volatile, process-isolated system memory with a hard Time-to-Live (TTL) of 180 seconds.
• No Disk Persistence & Explicit Zeroization: Plaintext credentials pending save are never written to disk, SQLite databases, or logs. Once encrypted into the vault or upon timeout/dismissal, memory buffers are immediately overwritten with zero bytes (\u0000).

5. Tracking, Telemetry, and Third-Party Disclosures

XG8 is committed to uncompromising user privacy:

• No Third-Party Analytics: The web portal and native applications do not embed Google Analytics, Firebase Analytics, Meta Pixel, or any commercial behavioral tracking SDKs.
• No Advertising or Monetization: The Service is free of advertising networks, marketing trackers, and data profiling. User data is never sold, rented, leased, or brokered.
• Minimal Server Diagnostics: Standard HTTP server diagnostic logs (IP address, timestamp, status code) are retained strictly for reverse-proxy routing, rate-limiting, and DDoS defense, and are purged routinely.

6. Account Deletion, Data Retention & GDPR Rights

Under the EU General Data Protection Regulation (GDPR), users possess full sovereign rights to their data, including the right of erasure (Art. 17 GDPR):

• Local Vaults: Users can permanently destroy all local vault data, keys, and cached credentials at any time by clearing application data in Android settings or uninstalling the app.
• Cloud Vaults: Account holders can execute an immediate and permanent hard-deletion of their account and all associated encrypted blobs via our Account & Data Deletion Portal or by emailing info@x-gate.app. Deletion is instantaneous with zero retention days.

7. Data Controller Identification and Contact

For legal inquiries, GDPR data requests, or security vulnerability disclosures, contact the data controller: