Privacy Policy for Petra Shield

•••, Ijbruglaan 1495, 1087 KM Amsterdam, The Netherlands. Contact for privacy matters: [email protected]. Company details are in our imprint.

Your vault is encrypted on your device with AES-256-GCM. The key is stored in the iOS Keychain or the Android Keystore. With Pro you can sync the vault between iPhone, iPad and Mac through your private iCloud storage; it stays encrypted in the process. We have no access to the vault and receive no vault data. Shield has no account, no tracking, no analytics tools and no advertising SDKs.

Vault content: passwords, 2FA secrets (TOTP), API keys and the related details such as title, user name and web address. This data is processed on your device and stored encrypted. Legal basis: contract, Art. 6(1)(b) GDPR.

Backup file: if you export a vault, the file is encrypted with your backup password. You decide where it is stored. Petra keeps no copy.

No account and no Petra server: Shield creates no account and has no server that stores vault data.

With Pro, Shield syncs vault entries between iPhone, iPad and Mac. To do so, the app stores the already encrypted vault in your private iCloud storage (key-value storage) at Apple. The vault key is synced through iCloud Keychain, which Apple encrypts end to end. No Petra server is involved. Neither ••• nor Apple can read the content. Transmission and storage in iCloud are subject to Apple's privacy terms. Legal basis: contract, Art. 6(1)(b) GDPR.

Android: there is no sync. The vault stays on the respective Android device.

Besides iCloud (section 4), Shield only makes the following connections. For each of them, the privacy policy of the respective recipient applies, insofar as the recipient is itself responsible.

• Leak check: when you start the check, or when the automatic scan runs in Pro, Shield calculates a SHA-1 hash of the password on your device. Only the first 5 characters of the hash are sent to the service Have I Been Pwned (api.pwnedpasswords.com). The service replies with all known hashes with this prefix; the comparison happens on your device. The request is padded. As with every connection, the device transmits its IP address in the process. Legal basis: contract, Art. 6(1)(b) GDPR.
• Website icons: for an entry with a web address, Shield loads the file /favicon.ico directly from that domain to display the icon. In doing so, the operator of the website sees the IP address of your device and that the icon was requested. Petra receives none of this. Legal basis: legitimate interest in displaying icons, Art. 6(1)(f) GDPR.
• Purchases and subscriptions: handled by Apple (App Store) or Google (Google Play) under their privacy terms. Shield only receives the entitlement status from the store, i.e. whether Pro is active. We do not receive payment data. Legal basis: contract, Art. 6(1)(b) GDPR.

Camera: Shield uses the camera only to scan QR codes, for example when adding an authenticator account. The analysis runs on your device. Images are neither stored nor transmitted.

Biometrics: Face ID, Touch ID or fingerprint are checked by the operating system. Shield receives no biometric data.

System AutoFill: so that suggestions appear in your system's AutoFill, Shield does not pass secret identifiers to the operating system: entry ID, domain, and user name or title. Passwords and codes are only decrypted after you confirm with Face ID, Touch ID or fingerprint. Legal basis: contract, Art. 6(1)(b) GDPR.

Screen recordings are blocked in the app.

Petra (•••) receives no vault data and has no access to it. There is no Petra server for vault data and therefore no processor for it either.

Outside your device, data only reaches the recipients in section 5: Have I Been Pwned for the leak check, the operator of a website when its icon is retrieved, and Apple or Google for purchases. With Pro, Apple is also involved in iCloud sync (section 4). We do not sell data and do not pass it on for advertising purposes.

Vault data remains on your device until you delete it in Shield. When you delete the app, the vault is removed from the device. With Pro, an encrypted copy also remains in your iCloud storage, where it stays until you remove it. There is no copy on our servers, so we cannot delete or restore vault data. Exported backup files remain where you saved them.

You have the usual rights under the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Since Petra does not process personal data about you on our servers, requests mostly concern purchases and subscriptions. For these, please contact Apple or Google. For everything else, write to [email protected].

You can lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. Our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), autoriteitpersoonsgegevens.nl.