Privacy
Privacy Policy
Effective September 4, 2026
Your vault is zero-knowledge. Passwords, usernames, TOTP seeds, URLs, and notes are encrypted on your device. Your vault passphrase and decrypted entries are never sent to AgnosticSync, Auth Yourself, CoreFeld, or PeakQuorum.
This policy applies to the AgnosticSync apps for macOS, iOS, Fedora, Windows, and Android, the installable web app, and the Agnostic Passwords service. CoreFeld LLC operates AgnosticSync.
Information processed
- Account authentication. Auth Yourself provides signed account and recent multi-factor-authentication claims. AgnosticSync uses the account subject, session binding, authentication time, and TOTP authentication method to authorize vault access.
- Encrypted vault. The sync service stores the encrypted vault document. Visible structural metadata includes encryption parameters, opaque entry identifiers, scope names, recipient labels and public keys, wrapped encryption keys, encrypted document size, revision identifiers, update time, and a generic client label. Entry contents remain encrypted.
- Device storage. The app keeps an encrypted vault copy and revision identifier in local application storage for offline access. Authentication tokens use session storage. Decrypted entries remain in volatile memory only while the vault is unlocked. The vault passphrase is kept the same way unless you choose Stay unlocked on this device, in which case it is stored in local application storage on that device until you lock, sign out, or clear the app's data.
- User-directed clipboard use. When you choose Copy, the selected value is placed on the operating system clipboard under your control.
- Service requests. Hosting and network providers necessarily process standard request information such as IP address, timestamp, requested path, and user agent to deliver and protect the service.
How information is used
Information is used only to authenticate you, synchronize your encrypted vault across your devices, provide recovery history for encrypted revisions, prevent abuse, diagnose failures, and support the service. AgnosticSync contains no advertising or analytics SDKs and does not sell, rent, or use personal data or vault data for advertising or model training.
Service providers
Auth Yourself supplies authentication. PeakQuorum hosts the application and encrypted vault storage. Apple and Google distribute the mobile apps, and Cloudflare delivers public desktop and Android installation files. These providers process information needed to provide their part of the service under their own terms. Vault plaintext and the vault passphrase are not disclosed to them.
Retention and deletion
The current encrypted vault and encrypted version history are retained while the service is active so devices can synchronize and recover from mistakes. Local ciphertext remains until app data is cleared or the app is removed. To request deletion of the server-side encrypted vault and account-linked service data, use AgnosticSync Support. Legal or security records may be retained where required.
Security and recovery
Vault entries use AES-256-GCM with keys derived or wrapped on the device. Transport uses HTTPS. The service cannot recover a forgotten vault passphrase or decrypt a vault for support. Keep the passphrase and an independent recovery copy safe.
Children
AgnosticSync is not directed to children under 13, and CoreFeld does not knowingly provide password-vault subscriptions to them.
Your choices and contact
You can lock the vault, sign out, clear local app data, remove the app, or request access, correction, or deletion through Support. CoreFeld LLC is located at 425 Broadway Ave S #331, Rochester, Minnesota 55904, United States.
Changes
Material changes will be posted here with a new effective date.