Privacy policy

1What it handles

To do its job, YanDunLock works with the items you choose to keep in your vault:

• Logins: titles, usernames and email addresses, passwords, websites, two-factor setup keys and notes.
• Other items: payment cards, identities (name, email, phone and address), secure notes and documents.
• Your extension settings, and an optional profile name and photo.
• The address of the page you are on, used only at that moment to show and fill the logins saved for that website. It is not recorded or kept.

2Where it is kept

• Your vault is encrypted with your master password and a Secret Key that stays in your computer's keychain. Without both, it cannot be opened.
• The extension keeps its own encrypted copy of the vault in your browser's storage on your computer, so it keeps working while the app is closed.
• While the vault is unlocked, the key that opens it is held only in the browser's memory. It is erased when the vault locks or the browser quits.
• The extension and the app exchange changes directly on your computer, through the browser's native messaging. Nothing passes through the internet or any server.

3What websites see

• A web page receives a login only for its own website, and only when you pick it or ask YanDunLock to fill it.
• Everything YanDunLock shows on a page sits in a sealed layer that the page cannot read. Your master password is typed into a frame the page cannot see into.
• When you sign in or change a password, YanDunLock reads that form once to offer to save it. Nothing is saved until you choose to save it.

4Browser permissions

The extension asks your browser for these permissions, each for one reason:

• Access to websites: to find login and sign-up fields, fill the login you pick, suggest strong passwords and offer to save logins.
• Native messaging: to talk to the YanDunLock app on your computer.
• Storage: to keep the encrypted vault copy and your settings on your computer.
• Tabs and scripting: to match logins to the current website and keep open pages working after an update.
• Clipboard: to copy a username, password or code when you click Copy.
• Alarms and idle: to lock the vault after the time you chose, or when your computer locks if you turn that on.
• Site icons: to show each website's icon from the browser's own cache.

5Internet connections

• Website icons next to your logins come from your browser's own icon cache, or are fetched by the YanDunLock app from the website itself. Only the website's address is used.
• If you choose to check your passwords against known data breaches in the app, it uses a k-anonymity service (Have I Been Pwned). Only the first five characters of a scrambled form of each password leave your computer, never the password itself.

6What we never do

• No accounts, no cloud servers, no analytics, no advertising and no tracking.
• We do not sell, rent or transfer your data to anyone.
• We do not use your data for anything other than filling, saving and generating your passwords.
• We do not use your data to decide creditworthiness or for lending.

7Your choices

• Turn off filling by itself, save offers and password suggestions, or switch YanDunLock off for any site or field, in the extension's settings.
• Log out or disconnect the extension at any time. It then deletes its copy of your vault from the browser. Removing the extension deletes everything it stored.
• Your vault stays yours. Export it or delete it from the YanDunLock app whenever you want.

8Changes and contact

If this policy changes, the new version is posted on this page with a new date.