Privacy Policy

Effective date: October 29, 2026

This Privacy Policy explains how Icosahedron (“Icosahedron,” “we,” “us,” or “our”) collects, uses, stores, and protects information in connection with the Icosahedron desktop application, browser extension for Google Chrome, Microsoft Edge, and Firefox, mobile application, server daemon, and related websites and services (together, the “Service”). Icosahedron is a password and credential manager that stores your secrets on your device and runs the credential tasks you authorize, such as signing in, rotating a credential, or cancelling a subscription.

By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Summary

Icosahedron is designed around a zero-knowledge architecture. Your vault — including passwords, API keys, tokens, and other secrets — is encrypted on your device with keys derived from your master password, which we never receive or store. As a result, we cannot read, recover, or disclose the contents of your vault. We collect the minimum information required to operate the Service, we do not sell your data, and we do not use your data for advertising.

2. Information We Collect

Account information

When you create an account we collect your email address, sign-in metadata (such as the one-time codes we email you and the devices you have signed in from), and your licence and subscription state. We do not store your master password or anything derived from it.

Vault data

The credentials and secrets you save are encrypted locally before they ever leave your device. If you turn on cloud backup, we store only the resulting encrypted ciphertext so it can be restored on your other devices. We have no ability to decrypt it, and we do not learn which websites or services are in your vault.

Extension and automation data

To fill credentials and run the tasks you authorize, the extension and desktop application match the page address of the request against your vault on your device. This matching happens locally. We do not transmit your browsing history to our servers. The record of what was copied, filled, edited, or opened in your vault stays on your device.

Billing information

If you purchase a subscription, payments are processed by our third-party payment processor. We receive limited order and subscription metadata (such as plan and status) and never receive or store payment card numbers.

Diagnostic and usage data

We may collect limited diagnostic data (such as app version, operating system, crash reports, and feature-usage counts) to keep the Service reliable and secure. You can turn this off in settings. Every diagnostic event passes a redaction step that rejects anything shaped like a secret before it leaves your device, and diagnostic data never includes the contents of your vault.

Information we do not collect

• Your master password or any key derived from it.
• Decrypted contents of your vault.
• The pages you browse, beyond the on-device matching described above.
• Which websites or services are in your vault.
• Payment card numbers.
• Data sold or shared for advertising or unrelated purposes.

3. Browser Extension Permissions

The extension requests only the permissions needed for its single purpose — securely filling and managing your credentials and running the credential tasks you initiate:

• Storage — to keep encrypted vault data and settings available on your device.
• Active tab / scripting — to detect login fields and fill credentials on the page you are actively using, only when you invoke Icosahedron.
• Native messaging — to communicate securely with the Icosahedron desktop application on the same computer.

We do not use these permissions to collect information for any purpose other than providing the Service.

4. How We Use Information

• To provide, maintain, and secure the Service, including sync and backup of encrypted data.
• To authenticate you and protect your account against unauthorized access.
• To process transactions and manage subscriptions.
• To diagnose problems, prevent abuse, and improve reliability and security.
• To communicate with you about the Service, including security and transactional notices.
• To comply with legal obligations.

5. Chrome Web Store & Edge Add-ons Limited Use Disclosure

Icosahedron’s use of information received from Google APIs and the Chrome Web Store, and from the Microsoft Edge Add-ons store, adheres to the applicable Limited Use requirements, including the Chrome Web Store User Data Policy. Specifically:

• We only collect and use data required to provide and improve the Service’s single purpose.
• We do not sell user data or transfer it to third parties for advertising or unrelated purposes.
• We do not use or transfer user data to determine creditworthiness or for lending.
• We do not allow humans to read your data, except: with your explicit consent for a specific issue; where necessary for security or to comply with applicable law; or where the data is aggregated and de-identified. Vault contents remain encrypted and unreadable to us regardless.

6. How We Store and Protect Data

Vault data is encrypted on your device using industry-standard authenticated encryption, with keys derived from your master password using a memory-hard key-derivation function. Data in transit is protected with TLS. Managed cloud platforms run the Service; we operate no servers of our own. We apply access controls, monitoring, and least-privilege practices to that infrastructure. No method of storage or transmission is perfectly secure, but because your vault is end-to-end encrypted, its confidentiality does not depend on the security of our servers alone.

7. Sharing and Disclosure

We do not sell your personal information. We share limited information only:

• With service providers (sub-processors) who host infrastructure and encrypted backups, operate our database, process payments, provide optional sign-in with Apple or Google, or deliver communications on our behalf, under contractual confidentiality and data-protection obligations. None of them can read your vault.
• If you choose to use a CAPTCHA-solving service with your own key, the extension sends that service the page address and the widget’s public site key, never a credential.
• To comply with law, legal process, or valid governmental requests.
• To protect the rights, property, and safety of Icosahedron, our users, and the public.
• In connection with a merger, acquisition, or asset sale, subject to this Policy.

8. Data Retention

We retain account data for as long as your account is active. Encrypted backups keep the current copy of your vault and the three before it; each backup object is protected against deletion for 30 days after upload. Diagnostic events are kept for 90 days. When you delete your account, we delete or irreversibly de-identify associated data within a commercially reasonable period, except where retention is required by law or for legitimate security and accounting purposes.

9. Your Rights and Choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can manage much of your data directly in the app, and you can export your vault at any time, including after a subscription lapses. You may exercise other rights by contacting us. We will not discriminate against you for exercising these rights.

10. International Data Transfers

We may process information in countries other than your own. Where we transfer personal information internationally, we use appropriate safeguards consistent with applicable law.

11. Children’s Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted here with an updated effective date and, where appropriate, communicated to you.

13. Contact Us

Questions or requests regarding this Policy or your data can be sent through our contact page.