Privacy Policy

Effective Date: October 21, 2026

Armor Pass ("we", "our", or "the application", package name: com.sumpena.armorpass) is committed to protecting your privacy. This Privacy Policy explains how Armor Pass handles your information.

1. Information We Process

Armor Pass processes the following types of information strictly to provide offline password management, optional encrypted backup services, and subscription entitlement management:

• Vault Credentials: Usernames, passwords, notes, PINs, and custom fields that you enter into the application. All credentials are encrypted locally using AES-256-GCM authenticated encryption with keys derived via Argon2id.
• Google Account Information: If you choose to enable Google Drive Sync or connect your Web Vault, the app accesses your basic Google account identity (email address and name) solely to authenticate and connect to your Google Drive account.
• Biometric Data: If you enable biometric authentication (fingerprint or face unlock), verification is handled entirely by the Android operating system (Android BiometricPrompt & KeyStore). Armor Pass never collects, stores, or accesses your biometric data.
• Purchase History & Subscription Data: If you subscribe to Armor Pass Premium, transaction metadata (such as Google Play purchase tokens, product IDs, order timestamps, and entitlement expiration status) is processed via Google Play In-App Billing and RevenueCat to validate your subscription. We do not collect or store credit card or payment financial details.

2. How We Use Your Information

• Encrypt and decrypt your vault data locally on your device.
• Fill credentials securely into apps and websites via the Android Autofill service and the Armor Pass Browser Extension only when explicitly requested by you.
• Backup and synchronize encrypted vault files to your personal Google Drive storage (only if enabled).
• Validate subscription entitlements and activate Armor Pass Premium features (such as Web Vault access and automatic cloud sync).

3. Local, Web & Browser Extension Data Storage

Your vault data and master password are never stored in plaintext and are never sent to our servers. All sensitive data remains securely encrypted on your local device storage.

Web Application (Web Vault): The web application operates on a strict ephemeral in-memory model. Decrypted credentials, master passwords, and Google OAuth credentials exist purely in transient browser memory (RAM) while your session is active. Plaintext secrets are NEVER persisted to browser storage (localStorage, sessionStorage, IndexedDB, or cookies). Non-sensitive sync metadata in sessionStorage is automatically wiped upon locking the vault or closing the browser tab.

Browser Extension (Chrome / Edge / Chromium): The Armor Pass Browser Extension operates 100% locally inside your browser with zero external network requests. Your encrypted AES-256-GCM vault envelope and auto-lock timer setting are stored locally in chrome.storage.local. While unlocked, the derived session decryption key exists strictly in ephemeral in-memory storage (chrome.storage.session restricted to trusted extension contexts) and is automatically wiped upon inactivity auto-lock, manual lock, or closing the browser. Host permissions, active tab domain checks, and isolated Closed Shadow DOM scripts are used solely to match domains (anti-phishing) and autofill credentials upon your explicit click—browsing history and page contents are never collected or transmitted.

4. Subscriptions & Google Play In-App Billing

Armor Pass offers optional auto-renewing subscriptions (Armor Pass Premium) processed securely through Google Play In-App Billing and managed via RevenueCat (RevenueCat, Inc.):

• Billing & Auto-Renewal: Payment is charged to your Google Play account upon confirmation of purchase. Subscriptions automatically renew at the selected interval (monthly at Rp 9.400/month or yearly at Rp 94.000/year) unless auto-renew is turned off at least 24 hours before the end of the current billing cycle in Google Play Subscriptions.
• Free Trial: If eligible, new users receive a 7-day free trial. If not canceled before the end of the trial period, your account will be charged the chosen subscription fee.
• Managing & Canceling Subscriptions: You can manage or cancel your subscription at any time via the Google Play Store app (Google Play > Profile > Payments & subscriptions > Subscriptions). Canceling stops future billing; you retain premium access until the end of the current billing cycle.
• Refunds: All refund requests are handled according to Google Play's Refund Policy.
• Data Safety Disclosure (Purchase History): In compliance with Google Play Data Safety requirements, purchase history and subscription tokens are processed solely for account management and feature provisioning. RevenueCat and Google Play never have access to your master password, encryption keys, or vault contents.

5. Google Drive Integration & Google API Limited Use Disclosure

Armor Pass includes an optional feature allowing you to backup and sync your encrypted vault file with your personal Google Drive account.

• Restricted Scope: Armor Pass only requests access to the Google Drive Application Data folder (https://www.googleapis.com/auth/drive.appdata) and files created by the app (https://www.googleapis.com/auth/drive.file).
• No Access to Personal Files: Armor Pass cannot read, view, modify, or delete any other files, photos, or documents in your Google Drive.
• Direct Communication: Communication occurs directly between your device and Google's official Drive API endpoints. We do not operate intermediary proxy servers and never access your Google tokens or data.
• Limited Use Compliance: Armor Pass's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your Google user data is never transferred to third parties, never used for advertising, and never used to train machine learning models.

6. Analytics & Advertising

Armor Pass does not use analytics services or tracking libraries. Armor Pass does not display advertisements.

7. Data Sharing

We do not sell, rent, monetize, or share your personal information or vault data with third parties.

8. Security

We implement industry-standard cryptographic practices to safeguard your data, including:

• Zero-Knowledge client-side encryption (AES-256-GCM).
• High-memory key derivation (Argon2id KDF).
• Screen capture protection (Android FLAG_SECURE) to prevent unauthorized screenshots and recordings.
• Secure hardware-backed biometric authentication.

9. Children's Privacy

Armor Pass is not intended for children under 13 years of age. We do not knowingly collect personal information from children.

10. Data Deletion and User Rights

You have full control over your data at all times:

• Local Data: You can delete your vault data at any time from within the application, by clearing app data in Android Settings, or by disconnecting/uninstalling the Armor Pass Browser Extension.
• Google Drive Backup: You can delete your hidden backup file at any time from Google Drive web settings (Settings > Manage Apps > Armor Pass > Delete hidden app data) or by disconnecting your Google account in Armor Pass settings.

11. Contact

Developer: Langit Biru Cerah
Application: Armor Pass (com.sumpena.armorpass)
Email: [email protected]

Kebijakan Privasi

Tanggal Berlaku: 21 Oktober 2026

Armor Pass ("kami", atau "aplikasi", package name: com.sumpena.armorpass) berkomitmen penuh untuk melindungi privasi pengguna. Kebijakan Privasi ini menjelaskan bagaimana aplikasi Armor Pass mengelola informasi Anda.

1. Data yang Diproses

Armor Pass memproses jenis informasi berikut secara ketat hanya untuk menyediakan layanan brankas kata sandi offline, pencadangan terenkripsi opsional, dan pengelolaan langganan:

• Kredensial Brankas: Nama pengguna, kata sandi, catatan rahasia, PIN, dan bidang kustom dienkripsi secara lokal menggunakan AES-256-GCM dengan kunci dari fungsi Argon2id.
• Informasi Akun Google: Jika mengaktifkan Sinkronisasi Google Drive atau menyambungkan Web Vault, aplikasi mengakses identitas akun Google dasar (email dan nama) untuk menghubungkan brankas ke Google Drive pribadi Anda.
• Data Biometrik: Verifikasi biometrik ditangani sepenuhnya oleh Android BiometricPrompt & KeyStore. Armor Pass tidak pernah menyimpan data fisik biometrik Anda.
• Riwayat Pembelian & Data Langganan: Jika Anda membeli langganan Armor Pass Premium, data transaksi (seperti token pembelian Google Play, ID produk, tanggal transaksi, dan status masa aktif) diproses melalui Google Play In-App Billing dan RevenueCat untuk memvalidasi langganan Anda. Kami tidak mengumpulkan atau menyimpan rincian nomor kartu kredit atau informasi keuangan perbankan Anda.

2. Penggunaan Data

• Mengenkrpsi dan mendekripsi data brankas secara lokal di perangkat Anda.
• Mengisi kredensial secara aman ke dalam aplikasi dan situs web melalui layanan Android Autofill serta Ekstensi Peramban Armor Pass atas tindakan/persetujuan Anda.
• Mencadangkan dan menyinkronkan file brankas terenkripsi ke penyimpanan Google Drive pribadi Anda (hanya jika diaktifkan).
• Memverifikasi hak akses langganan dan mengaktifkan fitur Armor Pass Premium (seperti akses Web Vault dan sinkronisasi cloud otomatis).

3. Penyimpanan Data Lokal, Web & Ekstensi Peramban

Aplikasi Android: Data brankas dan master password Anda tidak pernah disimpan dalam format teks biasa (plaintext) dan tidak pernah dikirimkan ke server kami. Seluruh data tetap terenkripsi secara aman di perangkat lokal Anda.

Aplikasi Web (Web Vault): Web vault beroperasi menggunakan model memori transien (RAM) yang bersifat sementara. Kredensial yang didekripsi, master password, serta token autentikasi hanya berada di dalam memori peramban selama sesi aktif. Kredensial plaintext TIDAK PERNAH disimpan di penyimpanan persisten peramban (localStorage, sessionStorage, IndexedDB, maupun cookies). Metadata sinkronisasi non-sensitif di sessionStorage dibersihkan otomatis saat brankas dikunci atau tab ditutup.

Ekstensi Peramban (Chrome / Edge / Chromium): Ekstensi Peramban Armor Pass berjalan 100% secara lokal di peramban Anda tanpa koneksi jaringan eksternal apa pun. Berkas brankas terenkripsi AES-256-GCM dan preferensi waktu kunci otomatis disimpan secara lokal di chrome.storage.local. Saat sesi terbuka, kunci dekripsi sesi hanya berada di memori sementara (chrome.storage.session yang dibatasi untuk konteks tepercaya) dan langsung dihapus otomatis saat kunci otomatis (auto-lock) aktif, dikunci manual, atau peramban ditutup. Izin akses halaman (host permissions), pencocokan domain tab aktif, dan skrip Closed Shadow DOM semata-mata digunakan untuk mencocokkan domain situs (anti-phishing) dan mengisi kredensial saat Anda mengklik tombol pengisian—riwayat penjelajahan maupun isi halaman web tidak pernah dikumpulkan atau dikirim ke luar perangkat.

4. Langganan & Google Play In-App Billing

Armor Pass menyediakan opsi langganan berbayar perpanjangan otomatis (Armor Pass Premium) yang diproses secara aman melalui Google Play In-App Billing dan dikelola via RevenueCat (RevenueCat, Inc.):

• Penagihan & Perpanjangan Otomatis: Pembayaran ditagihkan ke akun Google Play Anda saat konfirmasi pembelian. Langganan diperpanjang otomatis sesuai periode yang dipilih (bulanan Rp 9.400/bulan atau tahunan Rp 94.000/tahun) kecuali perpanjangan otomatis dimatikan minimal 24 jam sebelum akhir periode berjalan melalui menu Langganan Google Play.
• Uji Coba Gratis (Free Trial): Pengguna baru yang memenuhi syarat mendapatkan uji coba gratis 7 hari. Jika tidak dibatalkan sebelum masa uji coba berakhir, akun Anda akan ditagih sesuai paket langganan yang dipilih.
• Pengelolaan & Pembatalan Langganan: Anda dapat mengelola atau membatalkan langganan kapan saja melalui aplikasi Google Play Store (Google Play > Profil > Pembayaran & langganan > Langganan). Pembatalan menghentikan tagihan berikutnya; Anda tetap dapat menikmati akses Premium hingga akhir periode berjalan.
• Pengembalian Dana (Refund): Seluruh permintaan pengembalian dana diproses sesuai dengan Kebijakan Pengembalian Dana Google Play (Google Play Refund Policy).
• Pengungkapan Keamanan Data (Data Safety - Riwayat Pembelian): Sesuai ketentuan Google Play Data Safety, riwayat pembelian dan token langganan diproses semata-mata untuk manajemen akun dan aktivasi fitur. Baik Google Play maupun RevenueCat tidak pernah memiliki akses ke master password, kunci enkripsi, atau data brankas Anda.

5. Integrasi Google Drive & Kepatuhan Google API

Armor Pass hanya meminta akses cakupan terbatas (restricted scope) yaitu drive.appdata dan drive.file. Kami tidak mengakses file pribadi lain di Google Drive Anda. Komunikasi berlangsung secara langsung dari perangkat Anda ke Google API tanpa server perantara pihak ketiga.

Penggunaan data pengguna Google API sepenuhnya mematuhi ketentuan Penggunaan Terbatas (Limited Use). Data Anda tidak pernah dialihkan ke pihak ketiga atau digunakan untuk periklanan maupun pelatihan machine learning.

6. Tanpa Iklan dan Tanpa Pelacak

Armor Pass tidak menggunakan library analitik pelacak dan bebas dari iklan.

7. Pembagian Data

Kami tidak menjual, menyewakan, memonetisasi, atau membagikan informasi pribadi atau data brankas Anda kepada pihak ketiga mana pun.

8. Keamanan & Arsitektur Zero-Knowledge

Kami menerapkan standar keamanan kriptografi tinggi untuk melindungi data Anda:

• Enkripsi sisi klien Zero-Knowledge (AES-256-GCM).
• Derivasi kunci memori tinggi (Argon2id KDF).
• Perlindungan layar Android (FLAG_SECURE) untuk mencegah tangkapan layar tanpa izin.
• Autentikasi biometrik yang didukung modul perangkat keras (hardware-backed).

9. Privasi Anak-Anak

Armor Pass tidak ditujukan untuk anak-anak di bawah usia 13 tahun. Kami tidak secara sengaja mengumpulkan informasi dari anak-anak.

10. Penghapusan Data dan Hak Pengguna

Anda memegang kendali penuh atas data Anda setiap saat:

• Data Lokal: Anda dapat menghapus data brankas kapan saja dari dalam aplikasi, melalui menu hapus data aplikasi di Pengaturan Android, atau dengan memutus/mencopot Ekstensi Peramban Armor Pass.
• Cadangan Google Drive: Anda dapat menghapus berkas cadangan kapan saja melalui setelan web Google Drive (Setelan > Kelola Aplikasi > Armor Pass > Hapus data aplikasi tersembunyi) atau dengan memutuskan tautan akun Google di menu Pengaturan Armor Pass.

11. Kontak

Pengembang: Langit Biru Cerah
Aplikasi: Armor Pass (com.sumpena.armorpass)
Email: [email protected]