Privacy Policy

1. Executive Overview and Zero-Knowledge Architecture

XG8 Password Keeper ("the Application", "the Service") is engineered under an uncompromising Zero-Knowledge cryptographic principle. The foundational design objective of the Service is that no entity—including the developers, hosting providers, or database administrators—can access, view, or decrypt your stored credentials, private notes, or authentication secrets.

All encryption and decryption operations take place exclusively on your local client device (browser runtime or native mobile application). Your Master Password is never transmitted over the network in plaintext, and the derived cryptographic keys never leave your local hardware environment.

2. Cryptographic Specifications and Local Encryption

To ensure military-grade confidentiality and integrity, XG8 Password Keeper implements industry-standard, peer-reviewed cryptographic algorithms:

• Key Derivation: Master Passwords undergo key derivation via Argon2id (or high-iteration PBKDF2-HMAC-SHA256 fallback) utilizing unique cryptographic salts generated client-side, mitigating brute-force and dictionary attacks.
• Vault Item Encryption: All sensitive records, usernames, passwords, two-factor authentication (TOTP) seed secrets, and notes are encrypted locally using AES-256-GCM (Advanced Encryption Standard in Galois/Counter Mode with 256-bit keys and 128-bit authentication tags).
• Authenticated Nonces: Every stored record is encrypted with a unique 96-bit cryptographic nonce to prevent replay attacks and cryptographic pattern analysis.

3. Server-Side Data Ingestion and Storage

The backend infrastructure and central synchronization datastore only receive, persist, and transmit opaque cryptographic artifacts:

• User account identifier and email address (for authentication and critical security communications).
• Client-side cryptographic salt (Base64-encoded) for key derivation consistency.
• Password verification hash (computed from the derived key, preventing the server from deriving the underlying Master Password).
• Two-Factor Authentication (TOTP) state and Base32 secrets (encrypted via the user's master key when stored in vault items).
• Encrypted vault payloads consisting exclusively of AES-256-GCM ciphertext, nonces, and authentication tags.

In the event of an infrastructure compromise or unauthorized database access, all vault contents remain mathematically unreadable and protected by AES-256-GCM encryption.

4. Tracking, Telemetry, and Third-Party Disclosures

XG8 Password Keeper is committed to total user privacy:

• No Third-Party Analytics: The web portal and native applications do not embed Google Analytics, Mixpanel, Firebase Analytics, Meta Pixel, or any third-party behavioral telemetry SDKs.
• No Commercial Advertising: The Service is entirely free of ad networks, tracking cookies, and user profiling mechanisms.
• No Data Monetization: Under no circumstances is user data sold, rented, leased, or disclosed to third parties.
• Server Logs: Standard HTTP server diagnostic logs (IP address, timestamp, requested endpoint) are maintained strictly for network firewall protection, DDoS mitigation, and operational health, and are routinely purged.

5. Communications and Security Alerts

Email notifications are restricted strictly to vital transactional and account lifecycle events:

• Account registration confirmation.
• Security event alerts (such as suspicious unlock attempts or password recovery operations).
• Emergency Recovery Key utilization notices.

Outbound communications are routed via secure TLS-encrypted SMTP connections. Marketing or promotional emails are never dispatched.

6. Account Deletion and Data Retention

Users maintain full sovereign control over their data. When an account or individual vault record is deleted:

• All associated encrypted blobs and account metadata are permanently excised from the active database (0 retention days).
• Local application memory is explicitly zeroized upon logout or session termination.
• To request deletion or delete your account immediately via self-service, visit our Account & Data Deletion Portal.

7. Contact and Inquiries

For legal inquiries, vulnerability disclosures, or technical security verification requests, contact the security team at: