OnePass Privacy Policy

Your vault lives in a database on your device, encrypted with keys derived from your master password and your Secret Key. To keep your devices in step, OnePass syncs the encrypted vault through your own iCloud account, in the OnePass app’s private CloudKit database. Apple stores those records under your Apple Account; their contents stay encrypted by OnePass, and we have no access to your iCloud data. Apple’s privacy policy applies to iCloud.

The same private database carries short-lived, encrypted requests between your own devices, for example when your Mac asks your iPhone to approve something.

Accounts on a OnePass sync server

Some accounts created with OnePass on other platforms keep their encrypted vault on a OnePass sync server instead of iCloud. If you restore such an account on an Apple device, the app talks to that server. When the server is the one we run, it holds:

• your encrypted vault records, which we cannot decrypt;
• a random account identifier, each device’s public key and an encrypted device name;
• the push notification token of each device, used to wake it when something changes;
• the size and time of each change.

The server keeps no plain IP addresses in its database. It uses one-way hashed values to limit the rate of requests and deletes them within two days. Our hosting provider, Supabase, may keep request logs, including IP addresses, for a short period. If you point OnePass at your own server, we are not involved.

None of these features sends your passwords or any other vault content.

Website icons

On by default. To show a site’s logo next to an item, OnePass downloads the icon directly from that website, for example from github.com for a GitHub login. The website sees a request from your device’s IP address, without cookies or any detail about you. Icons are cached on your device. You can turn this off in Settings > General > Website icons.

Breach checks in Watchtower

On by default. To tell you whether a password has appeared in a known data breach, OnePass uses the k-anonymity service of Have I Been Pwned (api.pwnedpasswords.com). It sends only the first 5 characters of a one-way hash of each password, and the answer is padded so its size reveals nothing. The comparison happens on your device. OnePass also downloads public lists of breached websites (haveibeenpwned.com) and of sites that support two-factor authentication or passkeys (2fa.directory); these downloads say nothing about your vault. The checks run when you open Watchtower, or after unlocking if you turned on Watchtower alerts. You can turn them off with the Check breaches switch in Watchtower.

Crypto balances

On by default, and only if you keep crypto wallet items. When you open the Crypto screen or pull to refresh, OnePass sends your wallets’ public addresses to public blockchain services (by default mempool.space, PublicNode and the Solana Foundation’s API) to read balances, and the coin names and your currency to CoinGecko for prices. Private keys and recovery phrases never leave your device. You can change the providers, use your own or turn the feature off in the Crypto settings.

Passkey setup pages

When you tap Add a passkey on a login, OnePass asks that login’s website for the address of its passkey setup page (the standard /.well-known/passkey-endpoints file) and opens it. The website sees a request from your device, without cookies or any detail about you.

Maps and addresses

When you type an address in a Location field, the text is sent to Apple Maps to suggest and place it. Apple’s privacy policy applies.

Adding a device and Apple Watch

Pairing a new device happens over your local network or directly between nearby devices, without any server. Your iPhone and your Apple Watch exchange data over Apple’s own connection between the two devices.

Notifications

The app registers with Apple’s push service so iCloud can wake it to sync and so your iPhone can show approval requests from your Mac. Watchtower alerts, if you turn them on, are created on your device and never name an item.

These features work without sending anything: AutoFill and passkeys, the Safari extension (it reads the forms of the page you are on to fill them, and keeps its own small settings in Safari’s extension storage), Face ID, Touch ID and Optic ID unlock, camera scanning of QR codes, the Emergency Kit PDF, Nearby items and travel detection (your location is processed on the device and not sent, not even to Apple’s geocoder), automatic Wi-Fi setup, the SSH agent and the other developer tools on Mac, imports, and the clipboard, which is cleared after 90 seconds.

• No analytics, telemetry or usage statistics.
• No crash reporting built into the app. If you choose to share crash reports with developers in your device settings, Apple may pass them to us under Apple’s own terms.
• No advertising and no tracking across apps or websites.
• No sale or sharing of personal data.
• No update checks of its own: the App Store versions are updated by the App Store.

• Everything in your vault can be edited, exported or deleted from the app.
• To remove the synced copy, delete your OnePass data from iCloud (on iPhone: Settings > your name > iCloud > Manage Account Storage > OnePass). Removing an account from a device in OnePass takes it off that device only.
• If your account is on our sync server and you want it removed, write to privacy@somalabs.me and we will delete it. We cannot find you by a name or an email address, because we never have one, so we will ask you for a detail only your device can show.
• Because we do not hold your keys, we cannot recover your vault if you lose your master password and your Emergency Kit.

OnePass is not directed to children, and we do not knowingly collect anything from anyone, children included.

If this policy changes, the new version will be posted here with a new date. A change that sends more data off your device will be described in the app before it takes effect.

If you have a question about this policy, email privacy@somalabs.me.