The decision
An account we do not have cannot leak.
The moment a product has accounts, it has a list of who its customers are, a way to lock them out, and something worth attacking. We would rather not hold any of that.
So the app has no sign-in screen. It encrypts on your phone, writes to your card, and forgets. There is no server-side you.
The cost is real: we cannot reset anything, cannot see whether your card worked, and cannot tell you what you stored. Support can help with the object and the app, never with your contents.
Plainly
What we do and do not hold.
- Your vault
- Never. It exists on your cards and, briefly, in your phone's memory while open.
- Your password
- Never. It is not stored anywhere, by us or on the card.
- An account
- There is none. Nothing to sign in to, nothing to delete.
- Your card contents
- Unreadable to us. We have no key and no copy.
- A shop order
- Yes, a name and address to post a package, handled like any other order.
The best way to protect
data is not to have it.