Privacy Policy

Effective: 17 October 2026

This policy explains what data mepass ("we", "us") processes when you use the mepass password manager at vault.mepass.io.vn, and how we handle Google user data.

1. Who we are
2. Data we store on our servers
3. Data that never leaves your device
4. Google user data
5. Limited Use disclosure
6. Sharing and selling
7. Retention and deletion
8. How to revoke Google access
9. Security
10. Children
11. Changes to this policy

1. Who we are

mepass is operated by Thang Nguyen. For any privacy question or request, contact nguyenvanchienthang@gmail.com.

2. Data we store on our servers

mepass is end-to-end encrypted. Our servers store only what is needed to run your account and sync your vault:

• Your email address — to identify your account and send you account emails (verification codes when you register or rebuild your account, and new-device alerts).
• Sign-in record — an OPAQUE registration record. It lets you sign in without your Master Password ever being sent to us; it cannot be used to decrypt your vault.
• Encrypted vault data — your items and the keys that protect them, encrypted on your device. We cannot read them.
• Devices — the name and type of each device signed in to your account, and when it was first and last active.
• Security log — a record of security-relevant actions on your account (for example, a device being added or removed).
• Account recovery (optional) — if you set up recovery questions, our recovery service keeps your contact email and cryptographically blinded values. It never sees your answers or your Master Password.
• IP addresses — used only to limit abuse of email sending. Our server deletes them within about two hours; our recovery service stores only a keyed hash of the IP, never the IP itself.

3. Data that never leaves your device

Your Master Password, your Secret Key, and the readable contents of your vault never leave your device. Everything you store in mepass is encrypted on your device before it is sent anywhere.

4. Google user data

Connecting Google Drive is optional. If you choose to back up your vault to Google Drive:

• Scope. mepass requests only https://www.googleapis.com/auth/drive.file. This allows mepass to create, read, update and delete only the files that mepass itself created in your Drive. mepass cannot see, read or change any other file in your Drive.
• What we do with it. mepass creates a folder named mepass in your Drive, writes encrypted backup files of your vault into it, keeps a limited number of older backups (rotating daily, weekly and monthly copies), and reads those files back when you restore or open a backup.
• Where it goes. Backup files are encrypted on your device before upload and are sent directly between your browser and Google. Google user data — the access token and the contents of your Drive files — is never sent to or stored on mepass servers.
• How long we keep the access token. The Google access token is kept only in your browser's memory for the current session (Google issues it for about one hour). It is not written to disk and not sent to us.
• No other use. We do not use Google user data for advertising, profiling, analytics or training of any AI or machine-learning model, and no human at mepass reads it.

5. Limited Use disclosure

6. Sharing and selling

We do not sell your data, we do not share it with advertisers, and we do not show ads. We use these service providers only to operate mepass:

• Cloudflare — hosting of the web app and the recovery service, and storage of encrypted server backups.
• Our server hosting provider — runs the mepass server, which holds only the data listed in section 2.
• Resend — delivers the emails mepass sends you (verification codes and security alerts).

When you share a vault with family members, they can read the items in that shared vault. We may disclose data if required by law; because your vault is end-to-end encrypted, we cannot disclose its contents.

7. Retention and deletion

• You can delete your account at any time in the app (Account page → “Xoá tài khoản” / Delete account). This immediately and permanently deletes your account data from our servers.
• Items you delete go to Trash and are removed permanently after 30 days. Shared vaults that are deleted are kept for 7 days so they can be restored, then permanently removed.
• Encrypted server backups are kept for up to 7 days.
• IP addresses used to limit email abuse are deleted from our server within about two hours; our recovery service keeps only a keyed hash of the IP.
• Backup files in your Google Drive belong to you: delete the mepass folder in your Drive to remove them.

8. How to revoke Google access

You can remove mepass's access to your Google Drive at any time at myaccount.google.com/permissions. After that, mepass can no longer read or write its backup files. Files already in your Drive stay there until you delete them.

9. Security

All connections use HTTPS. Your vault is encrypted on your device with keys derived from your Master Password and Secret Key, and data from our servers is verified on your device before use. No method of storage or transmission is completely secure, but end-to-end encryption means that a breach of our servers would not expose the contents of your vault.

10. Children

mepass is not directed to children under 13, and we do not knowingly collect data from them.

11. Changes to this policy

If we change this policy, we will publish the new version on this page with a new effective date. If a change materially affects how we handle your data or Google user data, we will email you before it takes effect.