Privacy Policy

1. Who we are and the law we follow

SoloSecretsManager is made by AiDigiApps, a sole proprietorship of Mahesh Shinde in India ("we", "us"), at B2-1122, Gokulam, Doddakallasandra, Kanakapura Main Road, Bengaluru, Karnataka 560062, India. Contact: support@aidigiapps.com.

We follow India's Digital Personal Data Protection Act, 2023. If you live in the European Union, the United Kingdom or another place with its own data protection law, you have the rights that law gives you as well (see Your rights).

This policy covers this website, the SoloSecretsManager apps, the server software and the licence shop. Read it with our Terms of Service.

2. The short version

• Your vault is encrypted on your devices. We cannot read it, and nobody can make us, because we don't have the keys.
• We collect only what we need to sell and deliver a licence, and to answer you.
• No ads, no trackers, no analytics, and we never sell or rent your data.

3. What we collect, and why

Visiting this website

No cookies, no analytics and no third-party scripts. If you pick Bright or Dark, your browser remembers that choice on your device; it is never sent to us. Our hosting provider (Amazon Web Services) handles your IP address to deliver the pages and to tell the pricing and buy pages which country you are in, so they show prices in your currency. Exchange rates are fetched by our shop from Exchange Rate API; your browser never contacts them. We do not keep access logs.

Your vault

Everything in your vault (passwords, 2FA codes, passkeys, cards, notes, files, even item names) is encrypted on your device before it is saved. The server stores only that encrypted data, plus what it needs to run: your email address for sign-in, the names you give your devices, when they were added and last synced, and sign-in records that protect your account, such as failed attempts. Your master password never leaves your device, not even as a hash.

If you run the server in your own cloud account, this data stays there and never reaches us. If we host the server for you, we store it in encrypted form and still cannot read your vault.

Connections your server and apps make

• Website icons: your server downloads the icon of a site you saved, from that site.
• Security monitor (only if you turn it on): your server downloads the public list of sites that support two-factor login from 2fa.directory.
• Breach check (only if allowed in server settings): the app sends the first 5 characters of a password's SHA-1 hash to Have I Been Pwned. The password itself never leaves your device.
• New version check (can be turned off): your server asks whether a newer version exists.
• Licence auto-renew (only if you turn it on): your server asks this website for the newest licence file and sends only the licence ID.

Buying a licence

We store your email address, your server's ID, the billing period, your licence history and the subscription ID from the payment service. We use them to issue, renew and move your licence and to email it to you. We never see or store your card or bank details.

Your licence account page

When you ask for a sign-in link, we email it to you; it works once, for 15 minutes. Signing in sets one cookie, used only on the account page, that expires after an hour. It is needed for the page to work, so we don't ask for consent.

Emails from us

We email you your licence, renewals and the sign-in links you ask for, from licence@solosecretsmanager.com. We send no marketing email.

Contacting support

If you email us, we keep your message and our reply to help you. Please never send us your password, recovery code or Emergency Kit.

4. Companies that process data for us

If you run your own server, your cloud provider (for example Google Cloud, AWS or Azure) holds your encrypted vault under your own agreement with them.

5. When we share data

We share personal data only with the companies above, to run the service, or when the law requires it. If an authority asks, we can hand over only what we have: licence and payment records. We cannot hand over the contents of any vault, because we cannot decrypt it. Where the law allows, we tell you about the request first.

6. How long we keep data

• Licence records: while your licence is active, and afterwards as long as tax and accounting law requires.
• Sign-in links: 15 minutes. Payment notifications we receive: 90 days.
• Support emails: as long as needed to help you, then deleted.
• Your vault: until you delete items or erase the vault. Deleted items stay in the trash for the time set on your server, then they are gone.

7. Your rights

You can ask us to show, correct, export or delete the personal data we hold about you, and you can withdraw any consent you gave. Email support@aidigiapps.com; we answer within 30 days. We may need to keep some licence and payment records where the law requires it.

Your vault data is always in your hands: export it or erase it in the app at any time.

If you aren't happy with our answer, you can complain to the Data Protection Board of India, or to the data protection authority where you live.

8. How we protect data

See Security. In short: end-to-end encryption, a server that cannot read your vault, approval for every new device, and a licence-signing key that never leaves Google Cloud's key service.

9. Children

SoloSecretsManager is not meant for children under 18, and we don't knowingly sell licences to them.

10. Changes to this policy

If we change this policy, we update the date at the top. If a change matters for how we use your data, we also email licence holders before it takes effect.