Skip to content
Legal

Privacy Policy

Last updated October 5, 2026

MoolKey is a deterministic, stateless password and PIN manager. The whole product is designed around a single idea: the less we hold, the less there is to leak. Your Master Key and every password or PIN it derives are computed on your device and never transmitted to us. This policy explains the account metadata and security records that we do process.

The short version

  • We never receive your Master Key or any generated password or PIN.
  • Account email or phone identifiers are masked on your device before they leave it when you choose to provide one; an account can also have no identifier. Your login email is stored for authentication.
  • The web app and browser extension can keep a separate, last-synced copy of your account catalogue on that device for offline browsing and generation.
  • We don’t sell your data or run advertising or retargeting campaigns.
  • The marketing site may use Google Analytics 4 and Microsoft Clarity for aggregate usage and UX measurement. Analytics events contain page and interaction metadata only; passwords, PINs, passphrases, identifiers, hashes, and generated credentials are never sent.
  • Derivation works fully offline - when it does, no request is sent at all.

What we store

When you use the hosted MoolKey backend with an account, we store only the minimum needed to authenticate you and sync your account metadata:

  • Your login email address.
  • A bcrypt hash of your login password (never the password itself).
  • Your first name and optional last name, used for your profile and account communications.
  • A two-letter country code supplied with a signup request when available. This is a coarse country estimate, not GPS or precise location.
  • For signup abuse limits, a random browser identifier is kept in the signup page's local storage; the API stores its one-way SHA-256 digest and signup count. The quota record expires after 90 days without a successful signup reservation, independently of account deletion. The digest is not an account credential and is not used to track browsing.
  • Optional account identifiers, masked when they are email or phone values, e.g. [email protected]. No identifier value is stored when you opt out.
  • Canonical app names you’ve saved, such as google or github.
  • A per-account version integer and password length.
  • For partner sharing: a link between two accounts, and a flag marking which accounts are shared.
  • Partner notifications, created and updated timestamps, audit records, and session-security data.

The local offline copy is stored only in that browser or installed app's private storage and is not sent back to MoolKey. The web app and browser extension use separate copies.

What we never store

  • Your Master Key.
  • Your Shared Key.
  • Any generated password or PIN.
  • The plaintext of your MoolKey login password.
  • Anything secret-shaped inside session tokens or audit logs.
  • Generated secrets in localStorage, IndexedDB, CacheStorage, or other persistent storage.

There is no encrypted vault of generated credentials. MoolKey recreates passwords and PINs from inputs you already know instead of decrypting a stored list.

Offline account data on your device

After you sign in while online, the web app and browser extension can each keep a last-synced copy of your saved account catalogue in that browser profile. It includes saved app names and the account settings needed to recreate a password or PIN, such as an optional masked identifier, flow, length, version, last-used time, shared-account display details, and an internal account ID used to keep records scoped to the correct MoolKey account. The copy does not include your Master Key, Shared Key, generated password, or generated PIN. A “Last synced” time is shown when the app uses this data.

Offline access is read-only: you can browse saved accounts and generate values, but changes to accounts or sharing require an internet connection. The cache is scoped to the signed-in account. Signing out or switching accounts clears the local account data; a small MoolKey-only cookie marker coordinates that invalidation between the web app and extension and is not an authentication credential. The cache is held by the browser and can also be removed if you clear site or extension data.

While a device has no internet connection, it cannot learn about a remote sign-out, account deletion, password change, or sharing change made elsewhere. The offline copy can therefore be out of date until the device reconnects and verifies the account with MoolKey. Protect access to your browser profile and device.

Partner sharing keeps this promise. When you share an account with a partner, both of you derive it from a Shared Key you agree on and type yourselves. We store the link between your two accounts and a shared on/off flag, not the Shared Key or generated credential.

How we use what we store

We process the limited data above to:

  • Authenticate you and keep your session secure.
  • Sync the account metadata that lets you re-derive the right password on any device.
  • Operate, maintain, and protect the service against abuse and fraud.
  • Comply with legal obligations where they apply.

Our lawful bases (where the GDPR applies) are performance of our contract with you, our legitimate interest in operating a secure service, and compliance with legal obligations.

Chrome extension

When you open the MoolKey extension on a website, it reads the active tab's address to suggest a site name. It does not read the page body, form fields, cookies, or browsing history. The full active-tab address is not sent to our servers. When you use online account features, the extension sends the canonical site name and the saved-entry details needed to look up or sync an entry to the MoolKey API. An identifier is included only when you provide one. It also sends the normalized site name to our first-party icon service to request a matching logo. Email and phone identifiers for saved entries are masked on your device before they are sent; free-form labels are sent as entered.

The API receives your account session cookie and may log connection details such as IP address, browser user agent, request time, route, and status for security and service reliability. During signup, the API may also receive a two-letter country code from the hosting network and a random browser ID; only a one-way digest of that ID is retained for the signup limit. Account names used for lookup may appear in request paths or query parameters. The icon service receives the normalized site key and ordinary connection details, but not your account session. The extension does not send your Master Key, Shared Key, generated passwords, or generated PINs to either service, and does not save those secrets. Its light/dark theme preference stays in extension-local browser storage and is separate from the website theme cookie. The hide-sites display preference and whether online account mode is enabled also stay in extension-local browser storage. The separate offline account copy is kept in extension-local IndexedDB, not sent to a third party, and is cleared on sign-out or account change. Offline generation does not make network requests or read the active tab.

Our use of information received through Chrome APIs, including the active tab address, complies with the Chrome Web Store User Data Policy and its Limited Use requirements. We use this information only to suggest the site name for password and PIN generation and to provide the related account lookup; we do not use it for advertising or profiling.

Choosing Feedback in the extension opens the MoolKey web app. If you submit feedback there, we store the user-generated message, its category, any optional rating, the feedback-page URL, browser user agent, and your account reference so we can review and respond. Feedback submitted from the extension opens in the MoolKey website and is recorded as web feedback. After you uninstall the extension, Chrome opens an optional Google Forms survey. The extension does not read or transmit survey responses. If you submit one, Google Forms stores it and makes it available to MoolKey through the form; the extension does not send your MoolKey account reference with it. Google may process ordinary information about your visit under its own privacy policy. Do not include a Master Key, Shared Key, generated password, or PIN in feedback. Choosing Billing opens the MoolKey website; the extension itself does not collect or read payment fields. Dodo Payments processes payment details on the separate checkout page.

MoolKey staff may review website feedback to answer support requests and survey responses to understand product issues. Other account records are accessed only when needed to provide support the user requested, secure the service or investigate abuse, or comply with law. MoolKey cannot review Master Keys, Shared Keys, or generated credentials because they are not sent to the service.

Service providers and sharing

We do not sell personal information or share it for advertising. To run the service, we use Render for API hosting, MongoDB Atlas for database hosting, Cloudflare for network protection and Turnstile checks on web forms, and Brevo to deliver requested account-verification and password-reset emails. Google Forms hosts the optional post-uninstall feedback survey; Google processes submitted answers and ordinary service metadata for that page. If you choose to purchase a plan through the MoolKey website, Dodo Payments processes the checkout; MoolKey receives the subscription and transaction records needed to manage your plan, not your full payment-card number. These providers process data only to provide or protect the services they supply. Partner sharing is limited to the account metadata you explicitly choose to share.

Marketing analytics

The marketing site is delivered through Google Tag Manager. Its configured Google Analytics 4 tags measure page views, navigation, content selection, tool usage, and visits to the separate MoolKey app. Microsoft Clarity may measure clicks, scrolling, page performance, and session behavior on all marketing and free-tool pages.

Clarity input and output areas are explicitly masked, including the homepage demonstration and every password, PIN, passphrase, strength-check, breach-check, and generated-value area. Masked content is not uploaded to Clarity. Analytics tags should be configured with the applicable consent requirements for the visitor’s location.

Cookies

The hosted app uses strictly necessary cookies for authentication and security. The API's HttpOnly session cookie is the authentication credential. The app and extension also use two non-authorizing MoolKey cookies scoped to moolkey.com: one opaque account marker to select the matching local cache and one logout tombstone to prevent cached data from reappearing after sign-out. They do not contain a raw user ID or grant access to the API. The marketing site and app share a first-partymoolkey-theme cookie scoped to moolkey.com to remember an explicit light or dark choice. It contains only this non-secret preference and is included with ordinary requests to MoolKey subdomains, including the API host; changing the theme makes no dedicated API request. If cookies are blocked, each site falls back to its own saved preference or system theme. The marketing site may also use analytics cookies or similar storage when the configured GA4 and Clarity tags are allowed. We do not use advertising or retargeting cookies. See ourCookie Policy for the details.

Data retention

Account metadata is retained for as long as your account is active. When you delete your account, we remove the associated metadata from production systems promptly and from backups within 30 days. Security and audit logs are retained for a limited period for fraud prevention and then deleted.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your data, and to object to or restrict certain processing. Because we hold so little, most of this is self-service from the operator console - but you can always reach us at[email protected] and we’ll help.

Children

MoolKey is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

International transfers

We may process the limited metadata described above in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

Changes to this policy

We’ll update this page when our practices change and revise the “last updated” date above. Material changes will be communicated through the app or by email.

Contact

Questions about privacy? Email[email protected].