Privacy Policy

1. Scope and who we are

This Privacy Policy explains how F1v3 Group LLC ("Stax Pass," "we," "us," or "our") handles personal information when you use the Stax Pass applications, website, account services, support, and related services (collectively, the "Service"). It does not govern a third-party website or service merely because you save its credentials in Stax Pass or follow a link to it.

2. Information we process

We collect information from you, from the app or device you use, from people who invite or share with you, from app-store and payment providers, and automatically from ordinary service operations.

Your vault content may contain sensitive information

You control what you place in Stax Pass. Depending on your choices, encrypted vault content may represent passwords, financial information, identity information, health information, private communications, or information about other people. You should store only content you are authorized to possess and process. We do not use vault content to infer characteristics about you, advertise to you, or build a profile about you.

Information designed to stay off our servers

The Service is designed so our servers do not receive your raw account password, raw recovery phrase, raw durable encryption keys, readable vault item fields, or readable imported password rows. A plaintext import file is selected and processed locally; accepted records are encrypted before ordinary synchronization. If you voluntarily include a secret in a support request or another communication outside the vault, that communication is not protected by the vault's zero-knowledge boundary.

Breached-password check

When you create an account, change your account password, or set a new one with your recovery phrase, the app checks whether that password has appeared in known data breaches and warns you if it has, so you can avoid protecting your vault with a password attackers already have. The check is designed so the password never leaves your device:

• Your device computes a one-way SHA-1 hash of the password and sends only the first five characters of that hash. Many unrelated passwords share those five characters, so they do not reveal your password or its full hash.
• Our server returns a list of shortened hashes of breached passwords that begin with those characters, and your device compares them locally. We do not learn whether your password matched.
• The request does not include your email address, account identifier, device identifier, or session. It is served through our content-delivery provider (Amazon Web Services), which, like any web request, receives your IP address and the requested range. We do not keep a record linking a check to you or your account.
• If your device is offline or the check cannot finish, the app relies on its built-in password rules and does not send anything else.

Where the breach data comes from. The list is Pwned Passwords from Have I Been Pwned, created by Troy Hunt: SHA-1 hashes of more than two billion passwords that have appeared in public data breaches. It contains no passwords from Stax Pass users. We download it and keep our own copy, in a compact form, on our infrastructure, and refresh it from time to time; we do not send your information to Have I Been Pwned. Pwned Passwords is made available under the Creative Commons Attribution 4.0 license. Stax Pass is not affiliated with or endorsed by Have I Been Pwned.

Stax Pass for Chrome

The Stax Pass extension for Chrome and other Chromium browsers runs on the web pages you open so it can find login forms and website passkey requests. Everything below happens on your device unless it says otherwise.

• Web pages. The extension reads the page you are on to find username, password, and passkey fields, show the Stax Pass menu, and fill the login you choose. It compares the page's address with your vault on your device to suggest matching logins. It does not send page contents, the addresses of pages you visit, or your browsing history to Stax Pass, and it does not track you across websites.
• Logins you type. When you sign in to a website while Stax Pass is unlocked, the extension may keep the username and password you typed in memory for up to 60 seconds so it can offer to save them, including on the next page. If you save, they are encrypted on your device before they are synced. If you do not, they are discarded. They are never written to disk unencrypted.
• Passkeys. When a website asks to create or use a passkey, Stax Pass shows its own prompt first. If you choose Stax Pass, the passkey is created or used on your device and its private key is stored only inside your encrypted vault. The extension reads the website's request only to show the prompt and answer it. If you choose Chrome's passkey options instead, the request goes to Chrome, and the terms and privacy practices of Google or of the passkey provider you pick there apply.
• Stored in your browser. The extension keeps an encrypted copy of your vault, your sign-in session, a random device ID, the emails you choose to remember, and its settings in the browser's storage on your device. The session lets the extension stay signed in, but it cannot open your vault without your account password or an approval from your phone. Logging out ends the session. Removing the extension deletes this browser storage.
• Clipboard. When you copy a value, the extension clears it from the clipboard after the time in your clipboard setting, if the clipboard still holds that value.

Chrome Web Store user data. Stax Pass's use of information received through the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use that information only to provide the password-manager features you use. We do not sell it, we do not use or transfer it for advertising or to determine creditworthiness or for lending, and we do not allow people to read it except with your consent, for security purposes, or to comply with law.

Website icons

To show a website's icon next to a saved login, the apps and the extension may load the icon from our icon server (icons.stax-pass.com) or directly from that website. Like any web request, the icon request includes your IP address and the icon's address, which can show the name of the website. It does not include your email address, account, or vault content, and we do not link icon requests to your account.

Biometrics

If you enable biometric unlock, your device's operating system performs the biometric check. Stax Pass does not receive or store your face image, fingerprint, voiceprint, or biometric template. The app uses the successful local check to release device-protected cryptographic material on that device.

3. How we use information

We use personal information only as reasonably necessary to:

• provide, synchronize, secure, maintain, and support the Service;
• authenticate accounts, verify email ownership, manage devices, recovery, permissions, and encrypted sharing;
• process subscriptions, trials, entitlements, storage limits, and family-plan access;
• detect, prevent, and investigate fraud, abuse, unauthorized access, malware, and security incidents;
• diagnose errors, preserve service integrity, and improve reliability and accessibility;
• communicate about account activity, security, policy changes, and support; and
• comply with law, enforce our agreements, and protect users, Stax Pass, and others.

We do not use encrypted vault content for advertising, train machine-learning models on it, or attempt to decrypt it for product analytics.

4. When we disclose information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We may disclose limited information in these circumstances:

• At your direction. When you invite someone, join a shared vault, assign permissions, share an item, transfer permitted control, or otherwise direct a disclosure. A recipient may retain information they were able to decrypt or copy while authorized.
• Service providers. To vendors that help provide cloud hosting, data storage, network delivery, transactional email, customer support, security, and similar operations, subject to contractual restrictions appropriate to their work.
• App stores and billing providers. To Apple, Google, or another purchase provider as needed to verify and administer subscriptions and entitlements. Their own privacy terms also apply to data they collect directly.
• Legal and safety reasons. If we reasonably believe disclosure is required by valid legal process or is necessary to protect rights, safety, security, or the integrity of the Service. Because we do not hold the material needed to decrypt zero-knowledge vault content, we cannot provide readable vault content we do not possess.
• Business changes. In connection with financing, due diligence, reorganization, acquisition, merger, or sale of assets, subject to confidentiality measures and applicable law.

We may use and disclose information that has been aggregated or de-identified so it cannot reasonably be linked to you. We do not attempt to re-identify it except to test whether de-identification remains effective.

5. Retention and deletion

We retain each category only as long as reasonably necessary for the purposes described above, including to provide an active account, honor deletion and synchronization state, secure the Service, resolve disputes, meet legal obligations, and enforce agreements. Retention depends on the record:

• active account, encrypted vault, device, and sync records are generally kept while the account or record remains active;
• deleted items may remain as versioned deletion markers long enough to synchronize the deletion and protect against accidental reappearance;
• short-lived authentication, approval, and verification challenges expire under their security limits;
• security, fraud-prevention, support, billing, transaction, and legal records may be kept longer when reasonably necessary for those purposes;
• encrypted backups are overwritten or expire under our backup cycle and are not restored for ordinary use after a valid deletion request; and
• when deletion is complete, we may retain a narrowly limited tombstone, de-identified record, or other information required to document the request, prevent fraud, resolve disputes, or comply with law.

Deleting the app does not delete the server account. Use the in-app account-deletion control or the Delete Account page. After deletion we remove the live account and encrypted vault data, keep a narrowly limited UUID tombstone so other devices can wipe, and the original email may be used to create a new account. An offline device may retain its local encrypted copy until it reconnects or is wiped. Information another user already decrypted, copied, or exported from a shared vault is outside our technical control.

6. Your choices and privacy rights

You can review and change certain account and device information in the app, delete vault records, remove sharing access, revoke devices, and delete the account in the app or on the Delete Account page. Depending on where you live, you may also have rights to request access, correction, deletion, or a portable copy of personal information; to appeal a denied request; or to limit or object to certain processing.

Send a request to privacy@stax-pass.com from the account email and describe the right you want to exercise. We may verify your identity and authority before acting. We will not discriminate against you for exercising an applicable privacy right. Some requests may be limited where an exception applies, where fulfilling the request would expose another person's information, or where we cannot identify data inside encrypted vault content.

California disclosures

California residents may have rights to know, access, correct, and delete covered personal information and to receive information about its collection and disclosure. During the preceding 12 months, the categories we may have collected and disclosed for the business purposes described in this Policy are the categories listed in Section 2. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics or for purposes that would require a right to limit under California law.

Do Not Track and Global Privacy Control

The website does not use cross-site advertising trackers, so changing a browser's Do Not Track setting does not change our current practices. Where legally required, we treat a recognized Global Privacy Control signal as a request to opt out of sale or cross-context behavioral advertising; we do not currently engage in either practice.

7. Security and the shared responsibility model

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information we process. The product is built around local cryptographic operations, encrypted vault records, separate key roles, protected authentication records, access controls, and limited operational metadata. We review and improve safeguards as threats and the Service change.

No system can guarantee absolute security. Zero-knowledge architecture reduces what our servers can read, but it cannot protect information after you unlock, copy, export, disclose, or share it; prevent malware, phishing, screen capture, clipboard access, weak device security, or compromise of an authorized device; recover a forgotten account password without a working recovery path; or remotely erase an offline device immediately.

You are responsible for using a strong and unique account password, safeguarding recovery material separately, securing and updating your devices, reviewing trusted devices and sharing permissions, and reporting suspected unauthorized access promptly. We remain responsible for the obligations imposed on us by applicable law and for operating the safeguards we describe; this Policy does not transfer those obligations to you.

To report a suspected vulnerability or security incident, email security@stax-pass.com. Do not include live credentials, recovery phrases, or private vault content.

8. Children

Stax Pass is not directed to children under 13, and they may not create or use an account. If you are under the age of legal majority where you live, you may use the Service only with permission and supervision from a parent or legal guardian who accepts the Terms. If we learn that we collected personal information directly from a child under 13, we will take appropriate steps to delete it. Contact privacy@stax-pass.com.

9. Processing in the United States

Stax Pass is operated from the United States. If you use the Service from another country, information may be processed in the United States and other locations where our providers operate, subject to applicable safeguards and law.

10. Changes to this Policy

We may update this Policy as the Service, our practices, or legal requirements change. We will post the updated version and revise the date above. If a change materially reduces privacy protections or materially changes how we use personal information, we will provide additional notice when required and seek consent when the law requires it.

11. Contact us

F1v3 Group LLC operates Stax Pass. For privacy questions or requests, email privacy@stax-pass.com. For general support, email support@stax-pass.com.