Alpha Password is a password manager built so that the people who run it cannot read what you keep in it. This page says exactly what reaches our server, what we can read once it arrives, and what we cannot.
Last updated 11 October 2026.
Alpha Password is run by Alpha Zulu LLC, Albuquerque, New Mexico 87110, United States. We are responsible for the personal data described here (the “controller”, in European law). Write to privacy@alphapassword.app about anything on this page. Our terms cover the rest of how the service works.
Your master password never leaves your device. Everything in your vault is encrypted on your device before it is sent, with a key derived from that password. We store the result. We cannot decrypt it, and neither can anyone who compels or breaches us.
Signing in does not send your password either. Alpha Password uses OPAQUE, a sign-in method in which your device proves it knows the password without the password, or a hash of it, ever reaching us.
Alpha Password contains no analytics, no telemetry, no advertising and no crash reporting. The apps include two outside libraries: RevenueCat, which handles Pro purchases through the App Store and Google Play, and, on Android, Firebase Cloud Messaging, which wakes the app when your vault changes on another device. Both are listed below with what they receive. We do not use cookies for tracking, we do not build a profile of you, and we sell nothing to anybody.
| What | Can we read it? |
|---|---|
| Your email address | Yes. It identifies your account and is where we send recovery mail. |
| Names you give your devices, e.g. “Imogen’s iPhone” | Yes. Shown to you when approving a recovery. |
| Your password hint, if you set one | Yes. See below. |
| Your Pro purchase: which plan, the store, when it renews or ends | Yes. Needed to give you Pro on every device. |
| A message you send us from Report a problem, with the app version, system version and any screenshot you attach | Yes. We read it to answer you. |
| Push tokens for your devices | Yes. An address Apple or Google gives us so we can wake the app. It contains nothing about you. |
| Every item: passwords, notes, one-time-code secrets, passkeys, attachments | No. Encrypted on your device. |
| Your master password | No. It never leaves your device, in any form we could reverse. |
| Your recovery key | No. It is never uploaded. |
Encryption hides contents, not the existence of contents. We can see how many items you have, roughly how large each one is, when you last synced, how many devices you use, and who you have shared an item with. We would rather say so than imply otherwise.
Our server also sees the internet address (IP address) of each request. We use it to limit repeated attempts at signing in and similar abuse. It is kept in a counter that is erased a day after the last request from that address. If we block an address for abuse, we keep it until the block ends. It is not linked to your vault.
To show a site's logo next to a login, the apps ask our server for that
site's icon by its address, for example example.com. The
request carries no account, but our server does see which site's icon was
asked for and from which IP address. Icons are cached so each one is
fetched once.
Checkup can ask Have I Been Pwned, a public list of passwords exposed in past data breaches, whether any of yours are on it. It does this only when you press the button to check, never in the background, and never on its own.
A hint is optional. If you set one, we keep a readable copy so that we can email it to you when you have forgotten your password. A hint we cannot read is a hint we cannot send. It is the single piece of vault text you write that we can read. It is capped at 100 characters, the app refuses a hint that contains your password, and you can remove it at any time. If you never set a hint, we never have one.
Because we can read it, choose a hint that means nothing to anyone but you.
alphapassword.app sets no cookies and runs no analytics, advertising or tracking code. If you switch between light and dark, your browser remembers the choice; it is never sent to us. Cloudflare, which hosts the site, sees each request and its IP address, as any host does.
The browser vault at vault.alphapassword.app keeps a few things in your browser so it can work after a reload: the server and email address you last used, your password hint if you set one, and a device recovery you have started but not finished. It never stores your vault, your master password or your keys there. Clearing your browser’s site data removes all of it.
The apps can use a server you run yourself instead of ours. Your account and vault then live on that server, and whoever runs it is responsible for them. This page then covers only the parts that still reach us or the companies listed below.
We send email to keep your account working and safe: sign-in and recovery codes, device-approval requests, your hint when you ask for it, notices when your password is reset or a new device is let in, emergency-access requests, and replies to messages you send us. We send no marketing, and there is no list to unsubscribe from.
Mail is delivered through ZeptoMail (Zoho), who handle it on our behalf and see the messages in transit as any mail provider does. Seven days after a message is delivered we erase its contents from our system, keeping only the record that it was sent and to whom.
These companies process data for us. None of them can read your vault.
We share your data with nobody else. We have never received a government request for user data; if we do, what we are able to hand over is what this page says we can read, and no more.
European and UK law asks us to name a legal reason for each use of your data.
We are based in the United States, and our server and the companies listed above process data there and in other countries where they operate. If you are outside the United States, your data is transferred there. Your vault is encrypted before it leaves your device, wherever it is stored.
We answer every request within 30 days, and we never treat you differently for making one. We do not sell your personal data, and we do not share it for advertising, so there is nothing to opt out of under United States state privacy laws. If you are in Europe or the UK and are unhappy with our answer, you may complain to your data protection authority.
If we learn that someone has reached personal data we hold, we will tell you without delay, say what they could see, and tell the authorities where the law requires it. Your vault would still be ciphertext they cannot read.
An item you shared with somebody was decrypted on their device and may still be there. Deleting your account removes your copy and stops any future access; it does not reach into anybody else's phone, and we would rather say so than let you believe otherwise. If a shared password matters, change it before you delete.
Alpha Password is not for children under 13, or under the age the law where they live sets for agreeing to an online service. We do not knowingly create accounts for them. If you think a child has one, write to us and we will delete it.
The date at the top changes with it. If a change means we can read something we could not read before, we will say so in the app, not only here.
Alpha Zulu LLC, Albuquerque, New Mexico 87110, United States
privacy@alphapassword.app
Alpha Password