Privacy

Your passwords stay on your computer. This page lists everything this website ever receives.

What the OurLogins app sends

1. When you register an installation: the email address you type, and a random code the app creates for that installation (so it can later update or delete its own record). We store the email, a one-way hash of the code (not the code itself), and when the registration arrived.
2. At most once a day: the date (not the time) the app was last opened. We keep only the latest date.

Unless you sync between your computers (below), that is all. The app never sends your passwords, your master password, your vault, any spreadsheet you import, file names or locations, the websites you visit or fill, what you search for, how many logins you have, or anything about your browsing. There is no analytics or tracking in the app, the extension, or this website's pages.

To count how many people use OurLogins, each time you register or the app sends its daily date, our server tells PostHog (an analytics service) your email address, that you were active, and the time. The first time a computer is registered, it also records that first use against the same address. The download page uses that same address so a visit, a download, and later app use count as one person. Nothing else: not the installation code, your IP address, your computer’s name, or anything about your logins. Deleting your registration doesn’t remove this from PostHog; email privacy@ourlogins.com and we’ll delete it.

If you sync between your own computers

Sync is off until you set up another computer. Your computers then talk to each other directly whenever they can. Everything they send each other is encrypted on your computer with keys only your computers have, so nobody else can read it, including us.

To help your computers find each other, the app sends this website:

• Random ID numbers for your computers, and their public keys (which can’t unlock anything).
• How to reach each computer right now: its network addresses and the internet (IP) address it connected from. These are replaced about once a minute while OurLogins is open. We also keep when each computer was last seen.
• When your computers can’t connect to each other: changes sealed so that only your other computer can open them. We can see only their size and when they were sent. Each one is deleted as soon as your other computer picks it up, and after 30 days in any case.
• When you set up a new computer: a scrambled form of the one-time pairing code, which works for 10 minutes. The new computer’s name is encrypted, so we can’t read it.

Sync never sends your name, your email address, your passwords or your vault in a form we can read. In the app’s Settings, under Sync, you can choose Never use OurLogins servers. The app then asks us to delete everything above and sends us nothing more for sync. Your computers then sync only when both are on and can reach each other.

Checking for updates

About twice a day while it's open, the app downloads a small file from downloads.ourlogins.com to see whether there is a newer version. That request carries nothing about you: no email address, installation code, or anything about your logins. Like any website, the file host (Cloudflare) can see your IP address. An update is downloaded and installed only when you press Install and restart. You can turn the checks off in the app's Settings, under Updates.

What the browser extension handles

The extension runs only when you click its button, press its shortcut, or choose it from the right-click menu. Then it reads the address of the page you're on, looks for the page's sign-in boxes, and asks the OurLogins app on your computer for logins saved for that website. When you choose one, the app hands the username and password to the extension, which types them into the page.

All of this stays on your computer. The extension never connects to this website or anywhere else on the internet, never stores passwords or the pages you visit, and has no analytics. It only works while the OurLogins app is open and unlocked.

If you are offline

Everything works without the internet. If the app can't reach this website, it waits and tries again later. Whether this website is up never affects opening or unlocking OurLogins.

What we store

The installation code is kept in a file in the OurLogins folder on your computer, next to your encrypted vault. It is only an ID for your registration: it is not your master password and cannot open your vault.

How long we keep it

A registration is deleted automatically when the app hasn't been opened for 24 months.

For sync, a sealed change is deleted when it’s picked up, or after 30 days. A computer that hasn’t checked in for 24 months is forgotten, and so is everything about it. Remove this device and Never use OurLogins servers in the app delete what we hold straight away.

Deleting your registration

• In OurLogins, open Settings and, under Registration and privacy, press Delete my registration. This deletes the record on this website and the code on your computer.
• Or email privacy@ourlogins.com from the registered address and we will delete every registration for it.

Uninstalling OurLogins does not contact this website. Registrations from uninstalled copies are removed by the automatic deletion above, or sooner if you ask.

If you start a free trial, buy a plan, or use a coupon code

Your plan or trial belongs to an email address, so we keep:

• The email address, and when the account was made.
• When your free trial started and when it ends.
• Which plan you bought and when. For a monthly or yearly plan, whether it’s still active.
• Stripe’s reference numbers for you and your subscription, so we can match Stripe’s messages to your account.
• Whether you used a coupon code, when, and until when it makes OurLogins free. We don’t keep the code you typed: we keep a scrambled form of each code we hand out, so we can recognize it.

Payments are handled by Stripe. When you choose to buy, we send Stripe your email address (so you don’t have to type it again), the plan you picked, and our reference number for your account. On Stripe’s page you give Stripe your card number or other payment details; they go only to Stripe, and we never see them. Stripe tells us when a payment has gone through. Stripe’s own privacy policy covers what it does with your details.

If you only started a trial, or began buying and didn’t finish, we delete the account 24 months after the trial ended (or after you started buying). Records of purchases and coupon codes are kept, because they are what give you OurLogins. To have yours deleted, email privacy@ourlogins.com from that address.

This website

This website sets no cookies for visitors and loads nothing from other companies. Our server logs record the page address, response code, and timing — not email addresses, installation codes, coupon codes, or IP addresses.

What we don’t have

There is nothing to log in to, no copy of your passwords that we can read, and no way for us to reset or recover your master password. A plan or trial is only a record attached to your email address.