Privacy Policy

Last updated: August 2026

The PassStore application

PassStore is a native macOS application that runs on your computer. The complete source code is public under the MIT License in the PassStore GitHub repository. Your secrets, vault data, and Keychain items remain on your device under your control. We do not operate a cloud backend for your vault and do not receive your passwords or API keys from the app through PassStore's normal operation.

This website

This site is a marketing and download page. It does not require an account. We measure how the pages are used with our own analytics, hosted on our own server (a.makio.app): it sets no cookies, the data never leaves our infrastructure and is never combined with data from anywhere else. We record the page visited, the referring site, the device type, the browser, the operating system, the country, and interactions such as clicks, downloads, scroll depth and time on page.

Since 24 August 2026, and only if you agree, the same events also go to Google Analytics 4 (property G-GBBM50DM06), run by Google Ireland Limited as an independent controller for what it collects. This page used to say there was no Google Analytics here; that changed, and this is the notice.

Google receives the page address, the referrer, your IP address — from which it derives an approximate location — and your device and browser. It sets two cookies on this domain: _ga, which tells one browser from another, and _ga_GBBM50DM06, which holds the state of the session. Both last two years. We have switched advertising signals, ad personalisation and Google Signals off, so this is not used to build an advertising profile of you. Google is a US company and data may be processed outside the European Economic Area, under the EU–US Data Privacy Framework.

A banner asks before any of that happens. If you decline, no Google script is inserted into the page at all — not loaded and then muted. Our own counter, described above, runs either way and is unaffected by the choice. The legal bases differ for a reason: first-party measurement that sets nothing on your device can rely on the audience-measurement exemption, while Google Analytics cannot, under any reading.

Your IP address is never stored. It is turned into a hash that changes every day and differs per site, so it cannot be used to recognise you over time or to link your visits across different sites. There is no profiling, no advertising pixel, and we neither sell nor share this data. Statistics are deleted automatically after 400 days.

The one thing stored on your device is a session identifier in sessionStorage, which your browser discards when you close the tab. It exists only to keep the page views of a single visit together.

Downloads

When you download PassStore, your browser requests the file from our file host. That host may log standard technical data (such as IP address and timestamp) as part of normal HTTP access — the same as any file you download from the web. We also record that a download was started from this site, as an aggregate statistic: the file name and which button was used, nothing about you and nothing about the contents of your vault.

Contact

For questions about this policy, you can reach the developer via the Ko-fi page.