Privacy Policy

Our Zero-Knowledge Guarantee

All your passwords, usernames, and notes are securely locked on your device before they ever leave it. Our servers only receive scrambled, unreadable packages. We do not hold the keys to unlock them, making it technically impossible for us or anyone else to view your passwords.

Zero-Knowledge Architecture

Lokkia is built on a strict privacy model: everything you store is protected right on your own phone or computer before any synchronization takes place.

Because only your master password can open your vault, our servers cannot read, decrypt, or share your passwords, logins, cards, or notes. If our synchronization servers were ever compromised, your credentials would remain completely unreadable.

Why We Use Your Information

Lokkia only uses your information so the app can work for you: to sign you in, keep your vault in sync between your devices, fill in your logins, show website icons, and unlock PRO features when you have a plan.

We never use your information to track you, build a profile about you, show you ads, or sell it to anyone.

Data We Store

We collect the absolute minimum information required to operate your account:

Account Email Address

When you create an account, we store your email address. It is strictly used to identify your account, enable you to sign in, and send important service notices.

Encrypted Vault Data

When multi-device sync is enabled, we store your locked vault data. This information is entirely scrambled on your device and cannot be read by us.

No Master Password Storage

We never store, transmit, or have access to your master password. Only you know it. Because of this, if you lose your master password, we cannot recover it for you.

Browser Extension

The Lokkia browser extension needs a few pieces of information to fill in your logins. It uses them only so the extension works, never to track you:

Address of the Current Website

The extension reads the address of the website you are on to find the logins saved for it. This check happens only on your device. The extension does not keep a history of the websites you visit, and the address is never sent to us or anyone else, except the website name used to show its icon.

Login Fields on Web Pages

The extension looks for login, sign-up, and password fields on the page so it can show the Lokkia button and fill in your saved login when you choose it. It does not read or send anything else from the page, and it never records what you type.

Saved Logins and Passkeys

When you choose to save a login or a passkey for a website, it is locked on your device and added to your vault, then synced like the rest of your vault.

What Stays on Your Device

The extension keeps your settings (theme, language, auto-lock), a locked copy of your vault, and your sign-in session on your device. While your vault is unlocked, a protected copy of its key is also kept on your device so you do not have to type your master password every time you open your browser. It is erased as soon as you lock your vault, sign out, or reach your auto-lock time. Your master password and your passwords are never stored in a readable form.

The use of information received from the Lokkia extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Analytics & Crash Diagnostics

We believe in transparent, privacy-friendly diagnostics without intrusive tracking:

Firebase Screen Tracking & Crashlytics

On the website and in the mobile apps, we use Google Firebase only to detect app errors and see which screens are visited (for example, whether the Vault or Settings was opened). This helps us fix problems and improve the app, never to track you or show you ads. The browser extension does not use Firebase.

Website Icons

To show the logo of each website next to your logins, the app asks Lokkia’s servers for that logo. Only the site name (for example “github.com”) is requested, never your username, your password, or any other login details. The request is not linked to your account, and we do not keep a record of which sites you use.

What We Never Track

We never keep a history of the websites you visit, never record what you type, and never collect your passwords, usernames, or clipboard content. Nothing we receive is used for tracking or advertising.

Subscriptions & Billing

To manage upgrades and multi-device access:

RevenueCat Integration

When you are signed in, Lokkia shares only a random account identifier with RevenueCat (never your email address), strictly to check whether you have a Lokkia Pro plan, its renewals, and feature access.

Secure Payment Processing

Payment transactions are processed directly by Apple App Store, Google Play Store, or authorized payment providers. Lokkia never receives or stores your credit card or bank account details.

Who We Share Data With

We only share what each partner needs to make Lokkia work, and nothing more:

• Our French hosting company: stores your account email and your locked vault on servers in France.
• RevenueCat: receives a random account identifier (never your email address) to check whether you have a PRO plan.
• Apple App Store, Google Play, and RevenueCat’s secure web checkout: handle your payment when you buy a PRO plan. Lokkia never sees your card details.
• Google Firebase: receives app error reports and which screens are opened on the website and in the mobile apps. The browser extension does not use Firebase.

We never sell your data, never use it for advertising, and never share it with anyone else, unless the law requires us to.

Local Storage & Essential Cookies

We do not use tracking cookies, advertising cookies, or third-party profiling scripts.

We only use strictly necessary local browser storage and secure session cookies to keep you signed in securely and allow offline access to your vault.

Everything sent between Lokkia and our servers travels over a secure, encrypted connection.

How Long We Keep Your Data

We keep your account email and your locked vault for as long as you have a Lokkia account, because the app needs them to sign you in and sync your devices.

When you ask to delete your account from the app settings, your account and all your synced data are permanently deleted after 30 days. You can change your mind at any time before then.

Sign-in sessions end as soon as you sign out, or automatically after one year without use. Data the app keeps on your device is erased when you sign out.

Your European Privacy Rights (GDPR)

In accordance with European data protection regulations (GDPR), you retain full sovereignty over your personal data:

• Right of Access: You can inspect your account details at any time.
• Right to Data Portability: You can export your entire vault in one click directly from the app settings.
• Right to Rectification: You can update your information whenever needed.
• Right to Erasure: You can request the permanent deletion of your account and all associated synchronized data.

French Company & European Hosting

Lokkia is created and operated by a French company. The website, databases, and synchronization servers are hosted in France (European Union) by a French hosting company, strictly shielded by European privacy laws and the GDPR.

Your account and your locked vault are stored only in France. The partners listed in “Who We Share Data With” only receive the limited information described there.

Contact Us & Data Requests

If you have any questions regarding this Privacy Policy, wish to exercise your data rights, or request the deletion of your account, please reach out directly to our team:

Direct Privacy Contact: hello@lokkia.co

We respond to all requests within 48 business hours.