Privacy Policy
The short version. PassPony has no servers, no accounts, and no analytics. Your passwords and keys are stored encrypted on your device and are never sent to us — because there is no "us" to send them to. The only network connection the app makes is to the git remote you configure.
What PassPony is
PassPony is a client for the standard unix password store — pass (OpenPGP) and passage (age). It reads and writes encrypted files in a format you control, optionally synced over your own git repository. It is not a service. There is no PassPony account and no PassPony backend.
Data we collect
None. We operate no servers that receive your data. PassPony contains no analytics SDKs, no crash-reporting services, no advertising identifiers, and no third-party trackers of any kind. We cannot see your passwords, your keys, your entry names, how you use the app, or whether you use it at all.
What stays on your device
- Your keys — age identities and OpenPGP keys are stored on-device, protected by the operating system's data protection, and (optionally) a passphrase. They are never transmitted anywhere.
- Your store — the encrypted
.ageor.gpgfiles. Decryption happens locally; decrypted content exists only in memory while you are viewing an entry and is never written to disk. - The name index — to browse and search quickly, PassPony caches entry names and modification times. It never caches decrypted contents.
Network activity
PassPony makes exactly one kind of network connection: to the git remote you configure, to sync your store. If you use local-only mode or a folder-sync workflow, it makes no network connections at all. It contacts no other host for any reason.
What your git host can see
If you sync your store to a git remote (for example GitHub, GitLab, Codeberg, or your own server), the operator of that remote can see the same metadata the command-line tools expose: the names of your entries and your folder structure, and the timing of your changes. The contents of every entry remain encrypted to your keys and are opaque to the host. This is a property of the password-store format itself, not of PassPony, and we state it plainly rather than imply otherwise. Name your entries accordingly.
Autofill
The optional AutoFill extension reads from the same on-device store to fill credentials in your browser and apps. It shares the app's data through an app-group container on your device; nothing leaves the device. Access is gated behind your device biometrics and a passphrase-cache policy you control.
The clipboard
When you copy a password or code, PassPony writes it to the local clipboard only (never the shared/universal clipboard) and requests that the system expire it automatically after a short interval. Once on the clipboard, data is subject to your operating system's clipboard behavior.
Children
PassPony is a general-purpose utility and is not directed at children. It collects no personal information from anyone.
Changes to this policy
If this policy changes, the updated version will be posted here with a new date. Because we collect nothing, changes will generally be clarifications rather than expansions of data use.
Contact
Questions about privacy: NorseHorse@norsehor.se.