Privacy policy

1. Overview

Buddy Password Manager (“Buddy,” “we,” “our,” or “us”), a product of Brand New Byte LLC, is a local-first password manager for personal use. Your passwords and credentials are stored exclusively on your device and are never transmitted to our servers. We are committed to minimizing data collection to only what is strictly necessary to operate and protect the app.

No account or registration is required to use Buddy. This policy explains what limited data we do collect, why we collect it, and how it is used.

2. Data We Collect

2.1 Passwords and Vault Data

All passwords, credentials, and vault content are stored locally on your device only. This data is never sent to our servers. We have no access to your vault.

2.2 Device Identifier

During license activation, Buddy generates a hardware-derived device identifier. This identifier is a randomized string that cannot be used to identify you personally, determine your location, or reveal your device model or manufacturer.

The device identifier is used solely for:

Associating your license with a specific device
Detecting and preventing abuse of license keys (e.g., identifying compromised or shared keys)

2.3 Technical Metadata

During license activation and through an ongoing background process, Buddy sends the following technical information to our servers:

Device identifier (as described above)
App version
System architecture (e.g., x86_64, arm64)
IP address (collected server-side from the connection)

IP addresses are retained for observability and abuse prevention purposes — specifically to help identify compromised or fraudulently shared license keys. IP addresses are not used for advertising, profiling, or tracking your activity.

2.4 Order and Email Information (Paid Licenses Only)

If you purchase a license, your email address is collected at the time of purchase. This email is used exclusively for order-related communications, such as:

Delivery of your license key
Purchase receipts and invoices
Critical notices related to your license (e.g., key compromise notifications)

We do not add your purchase email to any marketing list, and we do not share your email address with third parties for advertising or promotional purposes. Our launch waitlist is a separate, opt-in list you have to join yourself — see Section 10. Users of the free trial are not required to provide an email address.

3. How We Use Your Data

We use the data described above only for the following purposes:

License validation: verifying that your license key is valid and authorizing app access
Device binding: associating your license with one or more authorized devices (per your license type)
Abuse prevention: detecting compromised, cloned, or fraudulently distributed license keys using device identifiers and IP addresses
Observability: monitoring the health and functionality of our licensing infrastructure
Order fulfillment: sending your license key and order-related communications (paid customers only)

We do not use any collected data for advertising, behavioral profiling, or sale to third parties.

4. Licensing Model

Buddy is available in the following modes:

Free trial: time-limited, per-device, no account required
Perpetual license: a one-time purchase covering a generous number of your personal devices, distributed as voucher keys (see the Terms for the exact grant)

License activation requires an internet connection so that we can validate your key and issue a runtime authorization token to your device. After activation, Buddy functions offline; however, a background process periodically communicates with our licensing servers (as described in Section 2.3) to support ongoing abuse detection.

5. Data Retention

We retain technical metadata (device identifiers, app version, architecture, and IP logs) for as long as your license is active and for a reasonable period thereafter for security and audit purposes. Email addresses are retained for as long as required to fulfill order obligations and comply with applicable legal and tax requirements.

You may contact us to request deletion of your data (see Section 9).

6. Data Sharing and Third Parties

We do not sell your data. We do not share your data with third parties for advertising or marketing purposes. We may share limited data with trusted service providers who assist with payment processing and email delivery, strictly for the purpose of order fulfillment. Any such providers are contractually prohibited from using your data for their own purposes.

We may disclose information if required by law or to respond to valid legal process.

7. Security

We apply industry-standard security practices to protect the limited data we collect, including encryption in transit (TLS) for all communications between Buddy and our licensing servers. Your vault data never leaves your device and is therefore outside the scope of our server-side security measures — you are responsible for the security of your device and any local backups.

8. Children’s Privacy

Buddy is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us so we can delete it promptly.

9. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, or delete personal data we hold about you. To make such a request, please contact us at the address below. We will respond within a reasonable timeframe and in accordance with applicable law.

Because vault data is stored locally on your device, we have no ability to access or delete it on your behalf — you control that data entirely.

10. This Website

Sections 1–9 describe the Buddy app. This section covers pwbuddy.com, which is operated separately and never has access to your vault.

10.1 Website Analytics

We run our own analytics on this site rather than using Google Analytics or any advertising network. It is cookieless and does not track you across sites or across visits.

To count a visitor without identifying one, we take your IP address and browser user-agent, combine them with a secret salt that is rotated every day, and store only the resulting hash. Your IP address is never written to our analytics store, the hash cannot be reversed to recover it, and because the salt changes daily the same visitor produces a different hash tomorrow — so there is no profile to build.

What we keep is aggregate: page view counts, approximate visitor counts, referring site, and coarse browser/OS/device categories, summarized per day.

10.2 Launch Waitlist

If you enter your email address into the waitlist form, we store it and send you a confirmation email. Your address is not added to the list until you click the link in that email. Addresses that are never confirmed are permanently deleted 30 days after signup, automatically.

We use the waitlist only to announce Buddy's release and significant milestones leading up to it — not for advertising, and never shared or sold. Every email we send carries a one-click unsubscribe link, and you can also ask us directly using the contact details in Section 12. Either way we remove you without question.

10.3 Contact Form

Messages you send through our contact form include the name, email address, category, and message text you provide. These are emailed to our support address and used solely to answer you. We do not add contact-form senders to any mailing list.

10.4 Cookies

This site sets only strictly necessary cookies: a session cookie and a cross-site request forgery token, both required for sign-in and form submission to work. We set no advertising, profiling, or third-party tracking cookies. If you never sign in or submit a form, nothing persistent is stored about you.

10.5 Service Providers

This website relies on a small number of third parties:

Stripe — payment processing. Card details go directly to Stripe; we never see or store them.
Resend — delivery of transactional and waitlist email.
Bunny Fonts — web font hosting, chosen because it sets no cookies and does not track visitors.
Amazon S3 — storage and delivery of application downloads.

Our web server also keeps standard access logs, including IP addresses, for security and troubleshooting. These are retained for a limited period and are not used for analytics or profiling.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this document. For material changes, we will provide notice within the app or via email (for paid license holders). Your continued use of Buddy after such changes constitutes your acceptance of the updated policy.

Privacy Policy