Privacy Policy

Your privacy, our priority.

Bittery is built on the principle that we should never be able to see your data. Here's exactly how we handle your information.

Last updated: March 1, 2026

1. Introduction

Bittery is a zero-knowledge password manager operated by Bittery Software ("we", "us", "our"), a sole proprietorship registered in Germany. This Privacy Policy explains how we collect, use, and protect information when you use our services, including the Bittery web app, desktop app, mobile app, browser extension, and this website (collectively, the "Service").

We are committed to your privacy. Bittery is designed so that we cannot access your passwords, vault data, or encryption keys — ever.

2. Zero-knowledge architecture

Bittery uses a zero-knowledge encryption model. This means:

  • All vault data (passwords, secure notes, credit cards, identities, TOTP secrets) is encrypted on your device using AES-256-GCM before it is transmitted to our servers.
  • Your Master Password and Secret Key never leave your device in plaintext. Authentication uses the SRP-6a protocol, which allows us to verify your identity without ever seeing your password.
  • Your Master Unlock Key is derived locally via PBKDF2 (310,000 iterations) and HKDF. We do not store, transmit, or have access to this key.
  • Encryption keys for shared vaults are exchanged using RSA-4096 key pairs generated on your device. Your private key is encrypted with your Master Unlock Key before storage.

In practical terms: we cannot read your stored data, we cannot reset your Master Password, and we cannot recover your vault if you lose both your password and Secret Key.

3. Information we collect

We collect only the minimum information necessary to operate the Service:

Account information: When you create an account, we collect your email address. This is used for authentication, account recovery communication, and service-related notifications.

Encrypted vault data: Your vault items are stored on our servers in encrypted form. We cannot decrypt this data.

Authentication data: We store SRP-6a verifiers and salts necessary for the authentication protocol. These cannot be used to derive your password.

Device information: When you sign in, we record basic device metadata (platform, browser, operating system) to help you manage active sessions and detect unauthorized access.

Usage metadata: We collect minimal technical data necessary to operate the Service, such as timestamps of authentication events, API request logs (without vault contents), and error reports.

Waitlist information: If you join the hosted beta waitlist, we collect the email address and optional details you submit so we can send beta invitations and product updates related to Bittery.

4. Information we do not collect

We do not collect, store, or have access to:

  • Your Master Password
  • Your Secret Key
  • Your Master Unlock Key or any derived encryption keys
  • Decrypted vault contents (passwords, notes, credit card details, identities, TOTP secrets)
  • Your private RSA key in unencrypted form
  • Browsing history, keystrokes, or clipboard data

5. How we use your information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity using the SRP-6a protocol
  • Sync your encrypted vault data across your devices
  • Send you essential service communications (e.g., security alerts, account verification)
  • Detect and prevent abuse, fraud, or security threats
  • Comply with legal obligations

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

6. Data storage and security

Your encrypted vault data is stored on servers located within the European Union. We implement appropriate technical and organizational measures to protect the data we store, including:

  • TLS encryption for all data in transit
  • AES-256-GCM encryption for all vault data at rest (client-side encrypted)
  • Regular security assessments and code reviews
  • Public source code allowing independent security review
  • Rate limiting and abuse detection on authentication endpoints

Because your vault data is encrypted with keys we never possess, even a hypothetical server breach would not expose your passwords or sensitive data in readable form.

7. Data retention

We retain your account information and encrypted vault data for as long as your account is active. If you delete your account, we will delete your data from our active systems within 30 days. Some data may persist in encrypted backups for up to 90 days before being permanently removed.

Audit logs and security event records may be retained for up to 12 months for security and compliance purposes.

8. Self-hosting

Bittery is source-available software that you can self-host on your own infrastructure under the Functional Source License. When you self-host Bittery, your data never touches our servers. This Privacy Policy applies only to the cloud-hosted version of the Service operated by Bittery Software.

9. Third-party services

We use a limited number of third-party services to operate Bittery:

  • Infrastructure providers: For hosting and delivering the Service. These providers process encrypted data on our behalf and are bound by data processing agreements.
  • Email delivery: For sending transactional emails (account verification, security alerts). These providers receive only your email address and message content.

We are not currently selling paid hosted subscriptions during the beta. If payments are introduced later, this policy will be updated to describe the relevant payment processor and data handling.

We carefully vet all third-party providers and require them to comply with applicable data protection regulations.

10. Your rights

Under the EU General Data Protection Regulation (GDPR) and applicable laws, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate personal data.
  • Erasure: Request deletion of your personal data and account.
  • Data portability: Export your vault data in a standard format (available within the app).
  • Restriction: Request that we restrict processing of your personal data.
  • Objection: Object to processing of your personal data.
  • Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.

11. Cookies and tracking

The Bittery application uses only essential cookies and local storage necessary for authentication and session management. We do not use tracking cookies, analytics trackers, or advertising pixels.

This marketing website may use minimal analytics to understand aggregate traffic patterns. We do not use this data to identify or profile individual users.

12. Children's privacy

The Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it promptly.

13. International data transfers

Your data is stored within the European Union. If we need to transfer data outside the EU/EEA, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions by the European Commission.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending you an email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Bittery Software Email: [email protected] Website: https://bittery.com

You also have the right to lodge a complaint with your local data protection authority.