Privacy Policy

Introduction

JWpass ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our password manager application and website (collectively, the "Service"), available at jwpass.com and through our mobile applications for iOS and Android.

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Account Information

When you create an account, we collect:

• Email address (for authentication and communication)
• Name (for display purposes within the application)
• Organization/congregation affiliation (for access control)

Encrypted Vault Data

Your passwords and secure notes are encrypted on your device before being transmitted to our servers. We use AES-GCM 256-bit encryption with keys derived using PBKDF2 (600,000 iterations). This means:

• We cannot read your stored passwords or secure notes
• Your encryption key never leaves your device
• Only you (and those you explicitly share with) can decrypt your data

Device Information

When using our mobile applications, we may collect:

• Device type and operating system version
• Application version
• Crash reports and performance data (anonymized)

Usage Information

We collect basic usage analytics to improve our Service:

• Login timestamps (for security monitoring)
• Feature usage patterns (anonymized)
• Error logs (to diagnose and fix issues)

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Enable secure sharing of credentials within your organization
• Send important service notifications and security alerts
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues or security threats
• Comply with legal obligations

Data Storage and Security

Zero-Knowledge Architecture

JWpass employs a zero-knowledge security model. Your master password is never transmitted to or stored on our servers. All encryption and decryption occurs locally on your device.

Infrastructure Security

We use industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• Encrypted database storage (Supabase/PostgreSQL)
• Regular security audits and vulnerability assessments
• Multi-factor authentication support
• Secure hosting on Vercel (web) and compliant cloud infrastructure

Data Location

Your encrypted data is stored on servers located in the United States. By using the Service, you consent to the transfer and storage of your information in the United States.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your organization: If you are part of a congregation or organization, administrators may have access to certain account information (but never your encrypted vault data).
• Service providers: We use trusted third-party services (Supabase for database, Vercel for hosting) that process data on our behalf under strict confidentiality agreements.
• Legal requirements: We may disclose information if required by law, subpoena, or other legal process. However, due to our zero-knowledge architecture, we cannot provide decrypted vault contents.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Third-Party Services

Our Service integrates with the following third-party services:

• Supabase: Database and authentication services.View their Privacy Policy
• Vercel: Web hosting and deployment.View their Privacy Policy
• Expo/EAS: Mobile app build and distribution services.View their Privacy Policy

Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can access and view your account information at any time through your profile settings.
• Correction: You can update or correct your account information through the application settings.
• Deletion: You can request deletion of your account and all associated data by contacting us at privacy@email.jwpass.com. We will process your request within 30 days.
• Export: You can export your vault data in a portable format through the application.
• Opt-out: You can opt out of non-essential communications through your notification preferences.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. If you request account deletion:

• Account information is deleted within 30 days
• Encrypted vault data is permanently deleted
• Anonymized usage data may be retained for analytics purposes
• Backup copies are purged within 90 days

We may retain certain information as required by law or for legitimate business purposes (such as fraud prevention or dispute resolution).

Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@email.jwpass.com. If we discover that a child under 13 has provided us with personal information, we will promptly delete such information from our servers.

Biometric Data (Mobile App)

Our mobile application supports biometric authentication (Face ID, Touch ID, fingerprint). Important information about biometric data:

• Local processing only: Biometric data is processed entirely on your device using your device's secure enclave.
• Never transmitted: We never receive, store, or have access to your biometric data.
• Optional feature: Biometric authentication is optional and can be disabled at any time in the app settings.

International Users

If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We take appropriate measures to ensure your data receives an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date at the top of this policy
• Sending an email notification for significant changes

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Service after any modifications indicates your acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy, your personal information, or our privacy practices, please contact us: