Back

.00 Privacy

Privacy policy

Last updated: September 30, 2026

// Who we are

Punk Vault (desktop and mobile apps and the Chrome extension) is made by Devpunks Srl, Via Vincenzo Lancia 31/20, 10141 Torino, Italy (VAT IT12778070016). It is a client for the Devpunks password server at vault.devpunks.com. Contact: admin@devpunks.com.

// What Punk Vault handles

Your account email, and the items you save in your vault (logins, passwords, notes, cards, identities, SSH keys, files and Sends). Vault items are encrypted on your device with a key derived from your master password before they are sent to the server. Devpunks cannot read them. Your master password is never sent anywhere.

// Where data goes

  • vault.devpunks.com: login, sync and storage of your encrypted vault. This is the only server that receives your vault data.
  • api.pwnedpasswords.com (Have I Been Pwned): only if you run a breach check. We send the first 5 characters of the password's SHA-1 hash (k-anonymity), never the password or the full hash.
  • Website icons are loaded from vault.devpunks.com for the sites saved in your vault.

// Chrome extension permissions

  • activeTab and scripting: to read the address of the page you are on, so we can suggest matching logins. When you click "Fill", we enter your username and password into that page. The extension does not read page content, and it does nothing on pages unless you ask.
  • storage: keeps your encrypted vault and settings on your device. While the vault is unlocked, the key is held in memory-only session storage, which Chrome clears when it closes.
  • clipboardWrite and clipboardRead: to copy passwords and codes, and to clear the clipboard again after the delay you choose.
  • Host access to vault.devpunks.com and api.pwnedpasswords.com: for the connections described above.

// What we don't do

No analytics, tracking, advertising or telemetry. We don't collect browsing history. We don't sell or share data with third parties, and we don't use it for anything other than running the password manager.

// Retention and your rights

Your encrypted vault stays on vault.devpunks.com until you delete items or your account (Settings → Delete account). Logging out removes the local copy from your device. You can ask for access, correction or deletion of your account data at admin@devpunks.com, under the GDPR.