Montara Pass Privacy Policy
Last updated October 11, 2026

What Montara Pass stores about you, what it cannot read, and who else handles your data. Written from what the code does.

1. Privacy at a glance

Montara Pass encrypts your vault in your browser before anything leaves your device. Our server stores
ciphertext and wrapped keys. Your master password never reaches it, so we cannot read what is in your vault and
we cannot recover it for you.

This policy covers the website at montarapass.com, the hosted service at app.montarapass.com and the Montara
Pass browser extension. We run no advertising, sell no data and collect no usage analytics from the vault or
the extension.

Montara Pass can also be self-hosted. If you use a server run by someone else, or your own, that operator holds
the data described here and this policy does not apply to it. We receive nothing from a self-hosted ser
2. What we store about your account

Creating an account on the hosted service stores the following on our server:

• Your name and email address. If you sign in with Google, also the address of your Google profile picture.
• Your sign-in password, as an Argon2id hash. It is separate from your master password, which we never receive.
• Your sign-in sessions, each with the IP address and browser user agent it was started from.
• Your key set: the salt and settings used to derive your master key, your public key, and your vault key and
  private key in encrypted form.
• Your vault: items and folder names as ciphertext.
• A few facts about each item that stay readable so the apps can work: its type (such as login or secure note),
  when it was created and changed, whether it is in the trash, which of your folders it is in, and whether you
  marked it as a favorite.
• Sharing: which accounts an item is shared with, in which role, and who shared it.
• What we cannot read

Your master password is turned into a key on your device with Argon2id. That key opens your vault key, which
opens your private key, which opens one key per item. Items are encrypted with AES-256-GCM and item keys are
wrapped with RSA-OAEP. Only the encrypted forms are sent to us.

This means we cannot see the names, usernames, passwords, URLs or notes in your items, or the names of your
folders. Someone who copied our database would get the same ciphertext we have.

There is no recovery. If you forget your master password, nobody, including us, can open your vault.

1. Server logs and error reports
2. Request logs: for each request the server records the time, your IP address, the method and path, the
   response status and how long it took. Logs do not contain request bodies.
3. Rate limiting: your IP address is counted in memory for one minute at a time to limit abusive traffic.
4. Error reports: if the server crashes while handling a request, a report about that failure is sent to Sentry,
   our error-monitoring provider. Vault data in a request is already ciphertext.
5. The website
   Visiting montarapass.com involves three things beyond serving the pages:
6. Analytics: we count page views with Umami, which we host ourselves. It sets no cookies and builds no profile
   of you. It records the page, the referring site, and your browser, operating system, device type and country in
   aggregate.
7. Fonts: the website and the web app load their fonts from Google Fonts, so Google receives your IP address and
   user agent when a page loads.
8. Hosting: the website runs on Cloudflare, which processes your request, including your IP address, to deliver
   it.

The contact form on the website does not send anything yet. To reach us, email hello@montarapass.com; we
then hold your message and address for as long as the conversation needs.

1. The browser extension

The extension talks only to the Montara Pass server you point it at. It sends your sign-in email and password
to sign you in, and reads and writes your vault as ciphertext. It sends no telemetry and no browsing history,
and nothing goes to us unless that server is ours.

• Kept in the browser's local storage: the server address and your session tokens.
• Kept in memory only: your unlocked keys, cleared after 15 minutes without use, when the browser closes, or
  when you lock the vault.
• By default the extension touches a page only when you click Fill, and then only to fill the login form.
• If you turn on the menu in login fields, the extension runs on every site you open to find login fields. That
  happens in your browser; nothing about the pages is sent anywhere.
  7. How we use your data
• To run the service: your account, your sessions, and storing and sharing your encrypted vault.
• To send sign-in email: address verification, magic links and password resets.
• To keep the service secure and working: rate limiting, request logs and error reports.
• To see which pages of the website are read, in aggregate.
• To comply with the law where we must.
• Legal bases for processing

For users in the EU, UK and Switzerland: we process your account, sessions and vault data to perform our
contract with you (Art. 6(1)(b) GDPR), and logs, error reports and website analytics under our legitimate
interest in running a secure, working service (Art. 6(1)(f)).
9. Who else handles your data

We do not sell your data and we do not share it for advertising. These providers process some of it so the
service can run:

• Our hosting provider, which runs the server and the database that hold your account and your encrypted vault,
  in Singapore. - Resend, which delivers sign-in email and therefore receives your email address and the message.
• Google, if you choose to sign in with Google, and for fonts as described above.
• Cloudflare, which hosts the website.
• Sentry, which receives error reports.

We may disclose information if the law requires it. The most we can hand over is the account data listed above
and encrypted vault data. We cannot produce readable passwords.

1. Cookies and local storage

We use only what is needed to keep you signed in and remember your settings. There are no advertising cookiesand no cross-site trackers.

• Hosted service: a session cookie, cookies holding your access and refresh tokens, and one that remembers whether the sidebar is open.
• Website: your light or dark theme choice, kept in local storage.
• Data retention and deletion
• Sessions end after 7 days without use, and at most 5 are kept per account. Refresh tokens last 24 hours.
• Magic links expire after 15 minutes, password reset links after an hour.
• Items you delete stay in your trash until you delete them permanently there.
• Your account and vault are kept until you ask us to delete them.

There is no delete-account button in the app yet. Email hello@montarapass.com from your account's address and we will delete the account. That removes your key set, your folders and every item you own, including for the people you shared them with. Because we hold no keys, a deleted vault cannot be restored.

1. Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, or to delete it. Depending on where you live, you may also have the right to object to or restrict our processing and to complain to your data protection authority.

To exercise a right, contact hello@montarapass.com. We respond within 30 days. A copy of your vault can only ever be ciphertext; you can read your own items in the app at any time.

1. International data transfers

Montara Project is based in Indonesia, and the server and database of the hosted service are in Singapore. The other providers listed above may process data in other countries, so your data can leave the country you live in. Vault content is encrypted before it leaves your device wherever it is stored.

1. Children's privacy

Montara Pass is not intended for children under 16, and we do not knowingly collect their personal data.

1. Changes and contact

When this policy changes we update the date above. If a change is material, we tell account holders by email before it takes effect.

Questions about privacy can be sent to hello@montarapass.com, or by mail to Montara Project, Semarang, Indonesia.

The current version of this policy is at https://montarapass.com/privacy