Privacy Policy
Sezam — a password manager, as a browser extension and as a web app.
What Sezam is
Sezam is a zero-knowledge password manager: the server never sees anything you put in it. Passwords, notes and everything else are encrypted on your own device with a key derived from your master password. Only an encrypted container ever reaches the server, and the server cannot open it — it does not have the key.
This policy covers the browser extension (Chrome, Firefox) and the web app at sezam.onrender.com.
What leaves your device
- Your e-mail address. It is the name of the account: you sign in with it, and the server uses it to tell whose data is whose.
- Encrypted containers. Your vault items, encrypted on your device. The server stores them as opaque blobs.
- A device label. A name you choose yourself when you add a device (“laptop”, say), so you can tell in the list which device to revoke.
- Timestamps and revision numbers. When something last changed, so that devices can synchronise and conflicts can be detected.
The server never receives your master password, nor the contents of your items in readable form. The master password never leaves your device; the server only gets a proof derived from it, from which the password cannot be recovered. The server's operational log contains no passwords, no item contents and no addresses of the pages you visit.
What stays on your device
- Keys live in the core's memory. After you unlock, the account key is held in the browser's session memory (
storage.session): it survives the extension going to sleep and is gone when the browser closes. Keys are never written to disk. - A cache of the encrypted containers in IndexedDB, so Sezam works offline too. The data there is encrypted exactly as it is on the server.
- The offer to save a login after you submit a form waits in session memory only. Dismiss it, close the browser or let Sezam lock, and it is gone — it never reaches the disk or the server.
- Your choice of server (if you run your own) in the extension's local storage.
The content script
To be able to offer autofill, Sezam reads the login forms on the pages you visit: field types, their labels and attributes, the page address and its title. All of this happens on your device only. The page address is used to pick which of your logins are candidates for it — nothing about the pages you visit is sent to the server.
- A username and password are filled in only after you click a particular login, never on their own.
- A page is given a password only for the item you picked, and only for an address that belongs to it.
- Sezam never fills in new passwords or one-time codes.
- When you submit a login form with a password Sezam does not know, it offers to save it. You can decline.
The clipboard
A password you copy is wiped from the clipboard a minute later — but only if that password is still there. Whatever you copied in the meantime stays. To make that possible, Sezam works with a digest (SHA-256) of the copied text, never with the text itself.
Permissions, and why Sezam asks for them
storage- The cache of encrypted containers, the choice of server, and session memory for the key after you unlock.
alarms- Background synchronisation, locking after 15 minutes of inactivity, and wiping the clipboard after a minute.
activeTab- After you click the toolbar icon, Sezam learns the address of the open tab, so it can offer the logins for that page.
clipboardRead,clipboardWrite,offscreen(Chrome only)- Copying a password and wiping it from the clipboard later. In Chrome the clipboard is read in a hidden extension document (
offscreen); in Firefox the extension's background page does it directly. - A content script on all sites (
http://*/*,https://*/*) - A login form can be on any page. Sezam cannot know in advance which, so it needs access to all of them to recognise the form and offer to fill it. Page content is never sent anywhere.
- Access to the server's address (
host_permissions) - Synchronising with the Sezam server. If you choose your own server in the settings, Sezam asks for access to that address at that moment, and only with your consent.
What Sezam does not do
- No analytics, no traffic measurement, no tracking scripts.
- No third parties: your data is not handed over, sold or rented to anyone.
- No use of your data for any purpose other than running the service you asked for.
- No creditworthiness assessment and no other profiling.
- No advertising.
Deleting your account
You can delete your account from within the app at any time. Everything belonging to it is then removed from the server: the encrypted containers, the list of devices, and the account record with the e-mail address itself. For a while the data may still sit in the database's daily backup, which rotates itself according to the provider's retention. You can also revoke a single device without closing the account.
Your rights
Processing of personal data follows the GDPR. You have the right of access to your data, to its rectification and erasure, to restriction of processing and to portability. In practice all your data is in the app and you can delete it yourself at any time (an export to a file is in preparation); for anything else write to vaclav@matouch.cz.
Changes to this policy
If this policy changes, the effective date above changes with it. A material change to what leaves your device will be announced in the app before it takes effect.