Authsidian is a password and secrets manager built on a zero-knowledge model: your vault is encrypted on your device before anything reaches our servers, and we never hold the keys to decrypt it. This policy explains exactly what that means, what we can and cannot see, and which third parties are involved.
The short version
- Your vault is encrypted on your device with keys derived from your master password. We never receive your master password or your encryption key.
- Our servers store your email address, your encrypted vault and the technical metadata listed below that the service needs to work.
- We cannot reset your master password or recover your data if you lose it.
- Zero telemetry in all client apps (desktop, mobile and browser extensions): no analytics, advertising or crash-reporting SDKs. Our website uses no personal tracking cookies.
- Payments are handled by Lemon Squeezy. We never see your card number.
How the encryption works
When you create an account or sign in, your device derives keys from your master password with Argon2id, using 64 MB of memory, 3 iterations, a parallelism of 4 and a random 16-byte salt unique to your account. HKDF-SHA256 then splits the result into two independent 32-byte keys:
- An encryption key, which never leaves your device and is held in memory only while your vault is unlocked.
- An authentication key, which is sent to our server to prove that you know your master password. It cannot be used to decrypt your vault.
Every vault item is encrypted with AES-256-GCM using a fresh random 12-byte IV and a 16-byte authentication tag, so any tampering with stored data is detected and rejected on your device.
What our servers store
Our servers act as blind storage for your vault. This is the complete list of what we keep, and whether we can read it:
- Vault contentsEncrypted
- Names, usernames, passwords, notes, cards, 2FA secrets and attachments are stored only as ciphertext that we cannot read.
- Email addressReadable by us
- Identifies your account and lets us contact you about it.
- Key-derivation settingsReadable by us
- Your salt, iteration count and memory cost, so each of your devices derives the same keys. They do not reveal your master password.
- Authentication valueReadable by us
- Used to verify sign-ins. It is derived from your master password but is separate from your encryption key and cannot decrypt your vault.
- Item type and website domainReadable by us
- Stored in plain text next to each encrypted item (for example "login" and "github.com") to operate sync between your devices.
- Timestamps and sizesReadable by us
- When each item was created and updated, and the size of your encrypted vault.
- Devices and sessionsReadable by us
- Device name and type, last activity and session records. Refresh tokens are stored only as SHA-256 hashes.
- Security eventsReadable by us
- Sign-ins and device pairings, including the device name and IP address, shown to you in your security history.
- SubscriptionReadable by us
- Your plan, billing interval, status and renewal or end date, plus the customer and subscription identifiers Lemon Squeezy assigns. We never receive your card details.
- Email aliasesReadable by us
- Only if you use them: alias addresses, labels, on/off status and how many emails were forwarded.
- Push notification tokensReadable by us
- Only in the mobile app: the token, platform and device name used to deliver notifications.
- FeedbackReadable by us
- Only if you send it: the message, its type, your language and, if you choose to add it, your email address so we can reply.
Our API also uses IP addresses briefly to rate-limit requests. Those records expire automatically. We do not keep request logs of the content you sync.
Zero-knowledge trash
Deleted items go to a 30-day trash. The trash marker lives inside the encrypted item, so our servers do not know which of your items are in the trash. After 30 days your apps permanently delete expired items and remove their encrypted copy from our servers.
Authsidian Send
Authsidian Send lets you share a file or secret through an end-to-end encrypted link.
- The file is encrypted on your device. The decryption key travels only in the link fragment (the part after "#"), which browsers never send to our servers.
- Each transfer is limited to 100 MB, measured after encryption.
- You can protect a link with a password. We store only a hash of that password, never the password itself.
- Transfers self-destruct: they are deleted when they reach their download limit, and expired transfers are removed automatically.
- The file name, size and type are stored in plain text and are visible to anyone with the link. Avoid putting sensitive information in file names.
No password recovery
We cannot recover your master password.
There is no "reset password" and no backdoor. If you forget your master password and have no other way to recover it, the data in your vault is permanently unrecoverable, by you or by us.
The mobile app lets you create an Emergency Kit, which splits your master password into three fragments; any two of them rebuild it. The fragments are generated on your device and kept by you, and we never receive them. Anyone who obtains two fragments can recover your master password, so store them in separate, safe places.
Telemetry and analytics
The Authsidian desktop, mobile and browser extension apps include no analytics, advertising or crash-reporting SDKs and send no usage telemetry. They contact our servers only to sign in, sync your encrypted vault and run the features you choose.
Our website, authsidian.com, respects your privacy and uses no personal tracking cookies or third-party analytics scripts. We rely strictly on privacy-preserving, server-level metrics to measure aggregate visits without profiling visitors. The website loads Lemon Squeezy’s checkout script only when you choose to purchase a plan.
Third parties
We do not sell your data or share it with advertisers. These services process limited data on our behalf or at your request:
- Lemon Squeezy
- Merchant of record for purchases. It processes your payment details, billing address and taxes under its own privacy policy. We never receive your card number.
- Have I Been Pwned
- When you check a password for breaches, your device sends only the first 5 characters of its SHA-1 hash. The password and its full hash never leave your device.
- Expo push service
- Delivers notifications to the mobile app using your device’s push token.
- Hosting providers
- Run the servers and databases that hold the data described above, most of it encrypted.
Retention and deletion
We keep your account data for as long as your account exists. Send transfers are deleted when they expire or reach their download limit, and rate-limiting records expire on their own.
You can ask us to delete your account at any time by writing to privacy@authsidian.com. Deleting your account removes it and all associated data, including your encrypted vault, from our servers.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to or restrict its processing. Because your vault is encrypted, you control its contents directly, and the mobile app lets you export it. For any other request, contact us at privacy@authsidian.com.
Children
Authsidian is not directed at children under 16, and we do not knowingly collect their personal data.
Changes and contact
If we change this policy we will update this page and the date at the top, and we will notify account holders of material changes. Questions about privacy can be sent to privacy@authsidian.com. See also our Terms of Service.