Privacy Policy

Effective date: 1 September 2026

This policy is issued by Nanjing Xiaoxiaocheng Technology Co., Ltd. (“Xiaoxiaocheng Technology”) and applies to Password Vault. Using the service means you have read this policy.

Information we collect

We only collect what we need to run the service. Features you never turn on do not upload data for that purpose.

  • Account: email, phone number, or third-party sign-in IDs, plus avatar, display name, and security settings.
  • Cloud sync content: vault items (logins, TOTP, cards, secure notes) after end-to-end encryption. The server stores ciphertext only. The master password stays on this device and is never uploaded.
  • Browser extension: reads the page URL and login form so we can match and fill. Form contents stay on the device unless you save them; sync then uploads ciphertext only.
  • Official AI (optional): when you start folder organize, we send item titles, types, and site domains (never passwords, TOTP, or the master password) to suggest folders.
  • Device IDs: for sessions, the signed-in device list, and security checks.
  • These are not advertising IDs. We do not collect GAID / AAID for ads.
  • Purchase records: order verification from Google Play Billing or domestic payment channels, used to grant, restore, or check membership.
  • Service logs: IP address, time, request path, and coarse device type may be logged to protect accounts and debug failures. We do not use them for ads.

How we use information

We use it to authenticate you, sync the encrypted vault, autofill and save on this device, suggest folders when you ask, protect sessions, respond to support requests, and meet legal duties. We do not use it for targeted advertising.

Third-party processors

We share information only as needed to fulfill your request, verify payments, host infrastructure, or comply with law. Vendors may use the data only for the work we assign:

  • Google: order verification and subscription management for the Google Play build (Play Billing).
  • Alibaba Cloud Model Studio (Qwen): model inference when you start folder organize, using item titles, types, and site domains only. Passwords are not sent. We do not sell them to advertisers.
  • Cloud hosting and object storage: accounts, synced data, and attachments are stored on infrastructure in mainland China.
  • Alipay: payment verification for non-Google Play packages in China. Play purchases use Google Play Billing.

Sale of data and advertising

We do not sell your personal information and we do not share it with data brokers. Password Vault has no ads SDK and does not run cross-app advertising tracking.

Location

Password Vault does not collect precise location and does not request location permission.

Where we store data, how long, and security

Traffic is encrypted. Personal data is stored primarily in mainland China. If you use the Google Play build from another country or region, that data is transferred to China for processing. Continued use means you understand this arrangement.

You may request deletion in the app. After you submit the request we keep related data for 7 days so you can ask us to restore it, then delete or anonymize it unless the law requires a longer period. A vault that was never synced stays on your device for you to manage or erase.

Your choices

You can turn off sync, skip folder organize, manage signed-in devices, export your data, or write to us to correct or erase information.

Browser extension

The Password Vault extension talks only to the official backend (api-daymica.zysicyj.top) and does not load remote code. It must detect login forms on websites to autofill; that is the core of a password manager. Sensitive fields decrypt only in an unlocked on-device session and clear when you leave or when auto-lock fires.

Children

The service is intended for users 13 years and older and is not directed at children. If we learn we collected personal information from a child under 13, we will delete it promptly.

Updates

We may update this policy. Material changes will be posted on this page and, where appropriate, noted in the app. The latest text on this page controls.

Contact

Questions: use the website contact page or email hi@zysicyj.cn. Operator: Nanjing Xiaoxiaocheng Technology Co., Ltd. (Xiaoxiaocheng Technology / 小小澄科技).