Privacy Policy
This policy explains how the Password Manager website and desktop app handle your information. In one sentence: the website uses Baidu Analytics only to measure visits and referrers, and the app does not upload your vault.
1. Scope
This policy applies to this website and the Password Manager desktop app (local edition). The data controller is Beijing Huaxin Interactive Digital Technology Co., Ltd.
2. Website analytics and cookies
This website is static: it has no visitor accounts and sets no first-party business cookies of its own. To measure page views and referrers, the site loads Baidu Analytics (provided by Baidu, Inc.) through a same-origin loader, /analytics.js.
The hosting server may produce standard access logs (IP address, access time, request path, User-Agent), used only for security protection and troubleshooting; retention depends on the hosting provider's policy.
The site has no account registration, online payment, comments or form submission.
3. App data
The master password, vault contents and backups are stored only on your machine. The current version has no cloud sync or accounts and never uploads this data.
At startup and when you manually check for updates, the app requests https://www.elego.cn/downloads/latest.json for version information. It downloads an installer from the official website only after you confirm Update now, and verifies the update signature before installation. As with an ordinary HTTPS request, the website server may receive your IP address, User-Agent, request time and path; the requests contain no master password, vault contents or account information.
4. Local files
The app maintains the following files under ~/Library/Application Support/com.local.passwordmanager/ on macOS or %APPDATA%\com.local.passwordmanager\ on Windows:
- vault.enc: the AES-256-GCM-encrypted vault; contains no master password or plaintext entries.
- vault.enc.backup: a copy from before the most recent successful write.
- backup.enc: an encrypted backup you export yourself.
- settings.json: non-sensitive settings such as theme, auto-lock time and vault path; contains no passwords or keys.
- App logs: record only operation type, entry id, error code, counters and error text — never passwords, keys or entry contents. Logs are managed by the app and OS logging facilities; locations depend on the runtime environment.
5. Clipboard
Copying a username or password writes it to the system clipboard and attempts to clear it after 10 seconds by default; it also tries to clear on lock, window close or exit. The clipboard is a shared OS resource, so other apps may read it in the meantime.
6. Third-party services and cookies
The only third party is Baidu Analytics (hm.baidu.com), loaded solely to measure page views and referrers. The site loads no third-party fonts, CDN, ads or image resources and integrates no payment services.
Baidu Analytics receives your IP address (used only for coarse geolocation), User-Agent, referrer, the page path and full URL you visit, visit time, screen resolution and language preference. This data is stored on Baidu's servers; we only view aggregate reports, never use it for advertising, profiling or cross-site tracking, and do not export raw detail for long-term storage.
To opt out of analytics, disable JavaScript, block the hm.baidu.com domain or third-party cookies in your browser, or use a tracking blocker. If your browser sends Do Not Track or Global Privacy Control, the analytics script is not loaded at all. Reading this site and downloading installers do not depend on the analytics script, so these pages keep working without it.
Baidu Analytics' data practices are described in its privacy policy (https://tongji.baidu.com/web/help/article?id=330&type=0).
- HMACCOUNT, HMACCOUNT_BFESS (third-party cookie, .hm.baidu.com domain): visitor identifier, long-lived.
- HMVT (third-party cookie): cross-domain visit marker, current session only.
- Hm_lvt_<site id> (first-party cookie): first-visit timestamp, kept for 1 year.
- Hm_lpvt_<site id> (first-party cookie): last-visit timestamp, current session only.
7. Your data rights
Because we do not hold your data, deleting the app and its local data directory — and clearing its logs from the system log directory if present — completes removal. Export a backup.enc first, or the data cannot be recovered.
8. Policy updates
Updates to this policy will be published on this page with an effective date.
9. Contact us
Email：orrinzeng@hotmail.com