Privacy notice
Last updated: 2026-10-25
What data we process
Account data: email address, first name and last name.
Technical and security data: IP address, country (derived from the IP with a local database, without sending the IP to third parties), an identifier for each installation or device, platform (web, extension or app), date of last use, and a log of security events (sign-ins, password changes, lockouts, removals).
The contents of your vault (passwords, cards, notes and so on) are encrypted on your device before being sent. We store only encrypted data and cannot read it.
We use no analytics, advertising or behavioral profiling, and no third-party tools track you.
What we use it for
To create and operate your account and sync your vault between your devices.
To protect your account: email you about sign-ins from a new country or device, block abusive attempts and detect anomalies.
To send you security and service notices. We do not send advertising.
To comply with legal obligations when a competent authority requires it.
We do not sell your data or use it for any other purpose.
Who we share it with
We use providers that process data on our behalf, only to deliver the service: Mailgun (email delivery), Amazon Web Services (encrypted backups) and Cloudflare (traffic and site protection).
Some are outside Mexico, so your data may be transferred abroad for those purposes. Backups leave the server encrypted with a key that is not on the server.
Beyond that, we share it only with an authority when the law requires it.
How long we keep it
Your vault and account, for as long as you keep them. An item you send to the trash is permanently deleted after 30 days.
If you delete your account, it is removed immediately from the live database. If an administrator removes it, it stays in a trash for 30 days and is then deleted.
Encrypted backups are kept for up to 5 years and discarded when they expire; a deleted account may remain in them until then, unused.
Expired sessions are deleted after 24 hours. The security event log is kept for one year and then archived outside the system and removed from the database.
Your rights
You can access, rectify, cancel or object to the processing of your data (ARCO rights) and, where EU or UK data protection law applies to you, also request portability or restriction of processing.
You can exercise many of them yourself: export your vault as CSV, change your password, sign out your devices or delete your account from “My account”. For anything else, write to with your name and account email; we will reply within 20 days.
Security
Your vault is encrypted with XChaCha20-Poly1305 and your master password never leaves your device. If you lose it and your recovery codes, nobody can open your vault.
WolfPass has not undergone an external audit. If a breach significantly affects your rights, we will tell you without delay.
Browser extension
The extension uses the pages you visit only to fill in sign-in forms when you ask and to detect that you submitted one and offer to save it. It does not record your browsing or send the pages you visit.
The use of the information received complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: it is used only to operate the password manager and is not sold, transferred to third parties or used for advertising.
Minors
The service is not directed at minors and we do not knowingly process their data.
Cookies and local storage
We do not use cookies. What is stored in your browser is described on the “Local storage” page.
Changes and authority
If this notice changes, we will publish the new version here with its date.
If you believe your rights were violated, you can contact the data protection authority that applies to you (in Mexico, the Secretaría Anticorrupción y Buen Gobierno; in the European Union or the United Kingdom, the one in your country).