Privacy Policy

Last updated: November 9, 2026

Sharqey is an end-to-end encrypted password manager for teams, available as a web app at app.sharqey.com, a browser extension, desktop and mobile apps, and a CLI. This policy explains what data Sharqey processes, why, and what you can do about it.

Who is responsible

Sharqey is operated by Marek Mościchowski, Poland, who is the data controller for the Sharqey service. Contact: [email protected].

What we can't see

Secret values are encrypted on your device before they are sent to us, with keys that never leave your devices unencrypted. We cannot read:

• passwords, notes, environment values, one-time codes and files stored in secrets,
• your OpenPGP private keys and organization keys,
• passphrases and master passwords that protect your keys or local databases.

Local databases (.sharqey files) never reach our servers at all.

What we store

• Account: email address, optional first and last name, a salted hash of your password (if you sign in with one), public keys of your passkeys, your two-factor authentication secret and recovery code hashes, and identifiers of linked Sign in with Apple, Google or company SSO accounts.
• Organizations: names and structure of organizations and groups, memberships, roles and invitations, public keys, and encrypted copies of keys shared with members.
• Secrets: the encrypted value, plus the title, username and website address in plain text, so that search and autofill work without your keys. Do not put sensitive information in these fields.
• Recovery: if you enable account recovery, an encrypted copy of your private key that can only be unlocked as described in the recovery settings.
• Audit log: if an organization turns it on, a record of who accessed or changed which secret and when, visible to that organization's administrators.
• Technical data: our servers and Cloudflare process IP addresses and request metadata to deliver the service and protect it against abuse. We do not keep them in our database.

We use this data only to provide the service (contract performance, GDPR Art. 6(1)(b)) and to keep it secure (legitimate interest, Art. 6(1)(f)). We do not sell data, show ads, or use analytics or tracking tools.

Service providers

• Cloudflare (network, DDoS protection, Turnstile anti-bot check on sign-up, email forwarding for [email protected]).
• Amazon Web Services, Ireland (Amazon SES, sending transactional email such as sign-up verification and invitations).
• Oracle Cloud Infrastructure, Frankfurt, Germany (storing encrypted database backups).
• Paddle.com, our reseller and Merchant of Record, only if you buy a subscription. Paddle processes your payment and billing details as an independent controller under its own privacy notice. We receive what we need to manage the subscription (such as the buyer's name, email address, country and subscription status), never full card details. Refunds are described in our Refund Policy.
• Apple and Google, only if you choose to sign in with them; they tell us your account identifier and email address. If you turn on iCloud sync for a local database in the iOS app, the encrypted file is stored in your iCloud Drive under Apple's terms.

The application server and database are hosted in Poland. Some providers may process data outside the EEA under the European Commission's standard contractual clauses.

Mobile apps

The iOS and Android apps store your keys in the device keychain or keystore, protected by your PIN and, if you enable it, biometrics. Biometric data never leaves the operating system. The apps contain no analytics or advertising SDKs.

Browser extension

The Sharqey extension keeps your keys in the browser's extension storage, optionally encrypted with Touch ID or Windows Hello. To suggest logins, it sends the address of the current tab to your Sharqey server (app.sharqey.com or your self-hosted server) and receives matching entries, which it decrypts locally. When you fill a login on a site, it can save which form fields hold the username and password for that site's domain (field selectors only, never values), so filling works next time; these hints are shared across Sharqey users of the same server. The extension reads pages only to find login forms and fills them only when you choose a login. It does not collect browsing history or page content and contains no analytics. Its page API is available only on your Sharqey server.

How long we keep data

We keep your data while your account exists. When you delete your account, we remove it from our database immediately; it disappears from backups within 30 days. Organizations you were the only member of are deleted with your account. Secrets you created in organizations that still have other members belong to those organizations and stay there.

You can delete your account in Settings → Delete account in the web app or the mobile apps, or by emailing us. See how to delete your account.

Your rights

Under the GDPR you can request access to, correction, deletion or export of your personal data, restrict or object to processing, and lodge a complaint with a supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). Write to [email protected]. You can export your secrets at any time as an encrypted .sharqey file from organization settings in the web app, or with the Sharqey desktop app or CLI.

Children

Sharqey is not directed at children under 16.

Changes

We will announce material changes to this policy by email or in the app before they take effect.