Privacy Policy

The short version

Password generation happens entirely in your browser — we never see, receive, or store what you generate. One-time secrets are encrypted and stored only in scrambled form, with a key that never touches our servers. The rest of the site (visitor analytics, and optionally ads) is described in detail below.

Password Generator & One-Time Secret

Passwords are generated locally in your browser using the Web Crypto API (crypto.getRandomValues()). Nothing you generate is ever transmitted to our servers.

One-time secrets are encrypted before they're stored. Our server keeps only the scrambled version — never the decryption key, which exists only in the link you share. Once a secret is read, it's deleted immediately.

Anonymous site analytics

We keep basic visitor statistics for every page view: an hourly/daily-rotating one-way hash of your IP address (not the IP itself, and it changes every day so it can't track you over time), approximate country/city (from the IP, via a third-party lookup), device type, browser, operating system, browser language, referrer, and the page visited.

This is never linked to anything you generate or share, never sold, and never combined with an email, account, or persistent identifier. It's used only in our internal dashboard to understand traffic patterns.

Cookies

Passivato uses:

• Essential cookies — for things like remembering your dark/light theme preference. These aren't optional and don't require consent under GDPR.
• Advertising cookies (only if you accept them in the cookie banner) — used to show ads, including personalized ones based on your interests. If you decline, you'll still see ads, but non-personalized ones.

You can change your choice at any time by clearing your browser's local storage for this site, or by contacting us (below).

Advertising

Passivato may show ads served by Google (Google AdSense) to help keep the tools free. Depending on your cookie consent choice, these ads may be personalized based on your browsing activity across other sites, using cookies set by Google. You can control ad personalization globally via Google's Ad Settings.

Third parties

• ip-api.com — approximate geolocation for analytics (country/city only, 1-second timeout, failures are silently ignored).
• Google Fonts / AdSense — font and (optional, consent-gated) ad delivery.
• Unsplash — featured images for blog posts are sourced from Unsplash's free API, used under the standard Unsplash License (free for commercial and non-commercial use). Where available, photographer credit is shown beneath the image.

Your rights

Since we don't create accounts or store personal data tied to an identity, there's generally nothing to export or delete on our end beyond the anonymized analytics described above. If you have questions or a request regarding your data, reach out — see below.

Contact

Questions about this policy or a data request: [email protected].