Primitive Pass Privacy Policy

01Who we are

Primitive Pass is provided by PRIMITIVE AI LABS PTY LIMITED, trading as Primitive AI.

• ABN: 86 701 195 708
• ACN: 701 195 708
• Registered address: Unit 15, 42 Terrace Road, East Perth WA 6004, Australia
• Privacy contact: hello@primitiveai.com.au

This policy applies to Primitive Pass services that link to it, including the web vault, desktop app, browser extension and mobile applications, and related account services.

02Our privacy approach

We explain the security controls Primitive Pass uses without promising absolute security or claiming an independent audit.

03Information we collect and hold

Depending on the features a person uses, Primitive Pass may process the following categories.

Account and authentication information

We may process:

• email address;
• an opaque account identifier;
• OPAQUE authentication registration records;
• encrypted two-step sign-in authenticator secrets and salted hashes/usage state for recovery codes, when this optional feature is enabled;
• hashed session tokens;
• salted and hashed one-time verification codes;
• account and credential timestamps;
• credential revision and vault-initialisation state; and
• short-lived authentication state required to complete sign-up, sign-in, recovery, credential changes or account deletion.

Primitive Pass does not need the master password or Recovery Key in plaintext on the server.

Encrypted vault information

The service may store and synchronise encrypted records including:

• encrypted key bundles;
• encrypted vault and item records;
• encrypted secure notes, login records and API-secret records;
• encrypted sharing records where sharing is enabled; and
• sync revisions and record identifiers required to synchronise devices.

The service is designed so this server-side vault material is ciphertext rather than readable vault content.

Security and technical information

Primitive Pass may process limited technical information needed to operate and protect the service, such as:

• IP address used for abuse prevention and rate limiting;
• request timestamps;
• authentication and session events;
• service errors and security events; and
• app, browser, operating-system or protocol information where it is present in ordinary service logs.

We do not use this information for behavioural advertising.

Browser extension

The Primitive Pass Chrome extension has one purpose: to let you use credentials and passkeys from your Primitive Pass vault on websites you choose, while keeping vault contents encrypted.

• The Chrome Web Store build connects to this website for account sign-in and encrypted vault synchronisation.
• The extension asks for access to a website only when you enable that site. On an enabled site it may process the page address and login or passkey fields needed to save, match or fill a credential. Primitive Pass does not collect an ordinary browsing-history feed or arbitrary page content for advertising or analytics.
• When you choose to copy a vault secret, the extension places that value on the local clipboard. It checks whether the copied value is still present before clearing it, so it does not intentionally overwrite something you copied afterwards.
• Optional native messaging connects only to the Primitive Pass companion on the same computer, and only after you enable that feature and grant the browser permission.
• Website access, native messaging and CAPTCHA-skipping support are used only to provide Primitive Pass features requested by the user. They are not used for behavioural advertising or data brokerage.

Chrome Web Store Limited Use

Primitive Pass's use of information received through Chrome extension permissions complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use that information only to provide or improve the disclosed Primitive Pass password, passkey and secure-access features. We do not use or transfer it for personalised advertising, creditworthiness, lending decisions or unrelated data brokerage. We transfer it only when necessary to provide or improve those features, to comply with applicable law, to protect against malware, spam, phishing, fraud or abuse, or as part of a merger, acquisition or sale of assets after obtaining the user's explicit prior consent. Humans are not permitted to read Chrome extension user data except with the user's explicit consent for specific data, where necessary for security, where required by law, or where the data is aggregated and anonymised for lawful internal operations.

Email and support communications

If you sign up, sign in, recover an account or contact us, we may process the email address and message or delivery information needed for that communication.

Authentication emails are delivered through Resend.

If a user sends vault secrets or other sensitive material to support outside the normal Primitive Pass vault flow, that information may necessarily appear in the communication received by support. Users should not send passwords, Recovery Keys or vault contents to support unless specifically required through an approved secure support process.

Subscription information

Paid plans, when offered, are processed by Stripe. Stripe handles card and payment details; we do not store them. If we later offer purchases inside our mobile apps, Apple (App Store) or Google (Google Play) will process those purchases under their own terms. Primitive AI keeps only the information needed to link a purchase to an account: plan, status, billing period, email address and the payment provider’s customer and subscription references.

04Why we use information

We use personal information only for purposes reasonably connected to operating and protecting Primitive Pass, including to:

• create and administer accounts;
• verify email addresses;
• authenticate users and maintain sessions;
• synchronise encrypted vault data between authorised clients;
• support account recovery and credential changes;
• provide sharing or agent-access features a user chooses to enable;
• prevent abuse, fraud and unauthorised access;
• investigate incidents and maintain service security;
• provide support and service communications;
• administer paid entitlements where relevant;
• meet legal, accounting and regulatory obligations; and
• protect the rights, security and integrity of users, Primitive AI and the service.

We do not sell personal information or use Primitive Pass vault data for unrelated advertising.

05Zero-knowledge and local decryption

Primitive Pass is designed around the following boundary:

Primitive Pass encrypts your vault on your device before it is uploaded. Our server stores encrypted vault data and does not have the vault keys needed to read a locked vault. Sign-in uses OPAQUE, so your master password is not sent to or learned by the server.

Vault decryption occurs on an authorised client after the user unlocks the vault.

Primitive AI cannot simply reset a forgotten master password and decrypt the vault on the user's behalf. Where recovery is available, it relies on the user's Recovery Key and re-wrapping of the user's key material.

06Service providers and overseas processing

Primitive AI may use service providers to operate Primitive Pass. Providers should receive only the information reasonably required for their function.

The current launch design includes:

Some providers may process or store information outside Australia. Where applicable, Primitive AI takes reasonable steps appropriate to the service and applicable law when using overseas providers.

Our production server runs on our own self-hosted deployment infrastructure, on our server, hosted by Hetzner. We do not use Coolify Cloud.

07Retention

Primitive Pass seeks to keep identifiable account and security information only for as long as it is reasonably needed for the purpose for which it is held, subject to security, legal and operational requirements.

The account service currently defines the following short-lived periods:

• email verification code: 10 minutes;
• pending sign-up state: 15 minutes;
• OPAQUE login state: 2 minutes;
• account session: up to 30 days, unless revoked or otherwise invalidated sooner.

Security rate-limit information

IP rate-limit records are deleted no later than 24 hours after their active rate-limit window ends.

Logs and backups

Production logs are retained for 30 days. System backups are retained for up to 30 days.

User-created encrypted export/backup files are controlled by the user and are not automatically removed from the user's own storage when the Primitive Pass account is deleted.

08Account deletion

The account-deletion implementation is designed to require an authenticated session and a fresh OPAQUE proof of the account password before deletion.

When successful, the server-side deletion transaction removes the account and associated account data, including:

• email address and account record;
• OPAQUE password and recovery registration records;
• sessions and pending authentication state;
• email verification codes;
• key bundles;
• vault and vault-item records;
• sync history;
• sharing records identifying the account; and
• account-owned agent grants, approvals, audit events and execution receipts.

The deletion design retains only a SHA-256 hash of the former account identifier and the deletion timestamp as a deletion tombstone. It does not retain the deleted email address or vault data in that tombstone. Deletions made through your Primitive account also keep a record that the deletion happened (the random account ID, what was deleted, when, and each app’s confirmation) so we can show it was done; it does not include your email address or vault data.

You can delete your account in the web app. If you cannot use that feature, email hello@primitiveai.com.au and ask us to help with deletion. The mobile apps do not currently provide an in-app account-deletion option.

Active account and vault records are deleted when account deletion succeeds. Copies that remain temporarily in rolling system backups are removed as those backups expire, within 30 days.

09Local mobile data

The mobile applications are designed to keep only a read-only encrypted offline copy of the last accepted vault sync and limited account/sync metadata required to operate the app.

The encrypted offline copy is intended to be excluded from operating-system cloud backup or device-transfer backup.

Primitive Pass does not rely on advertising SDKs or behavioural tracking SDKs in the current mobile applications.

The mobile apps do not currently provide an in-app account-deletion option. Contact hello@primitiveai.com.au to request deletion; we will assist with the account deletion process.

10Access, correction and privacy requests

A user may contact hello@primitiveai.com.au to ask about personal information Primitive AI holds about them, request correction where appropriate, raise a privacy concern, or ask for assistance with deletion.

Some requests may require identity verification before information is disclosed or changed.

Where information is held only in encrypted vault form that Primitive AI cannot decrypt, our ability to provide readable vault contents is correspondingly limited. Users should use the product's export functionality while they can still unlock their vault.

11Security

Primitive Pass uses technical and organisational controls intended to reduce unauthorised access, disclosure, alteration and loss.

The product architecture includes client-side encryption, authenticated encryption, a separate account-authentication protocol, scoped network egress, session controls, rate limiting and fail-closed validation of untrusted server records.

No internet-connected service can promise absolute security. Security claims will be limited to controls and review evidence that actually exist.

12Data breaches and incidents

Primitive AI maintains a cyber security incident and data breach response process. If an incident affects personal information, Primitive AI will assess the incident and take notification or remediation steps required by applicable law and the circumstances.

13Children

Primitive Pass is intended for adults.

You must be at least 18 years old to create a Primitive Pass account.

Primitive Pass is not intended for the Apple Kids category or the Google Play Families programme at initial launch.

14Australia and other jurisdictions

Primitive AI is an Australian company and uses the Australian Privacy Principles as a responsible privacy benchmark where relevant to its activities.

Primitive Pass is initially offered for Australia. We will address applicable privacy requirements before deliberately marketing or distributing the service in other markets.

15Changes to this policy

We may update this policy when Primitive Pass features, providers, data practices or legal requirements materially change.

Where a change materially affects how personal information is handled, we will update the effective date and provide notice where appropriate.

16Contact

Privacy questions or requests: