KittyLock is a password manager that runs as a browser extension. This page explains which data the site and the extension handle, and where that data is stored.
Data in the vault
Passwords, usernames, and other records you save in KittyLock are encrypted in your browser with AES-GCM (format validus-enc-v1) before they leave the device. The encrypted file is written through the Google Drive API only to the AppData folder of your Google account. That folder is not listed in ordinary Drive. KittyLock has no server of its own that stores passwords.
Because the vault lives in your Google account, it is not tied to one computer. Today the Chrome extension opens it. Safari, Firefox, and other platforms are still in development. When they are available, they open the same file.
The master password, including the first 4 characters used for quick unlock, is never sent to the developers. KittyLock is zero-knowledge: we cannot read the contents of the vault.
Google account
The connection to Google Drive uses Google sign-in (OAuth). KittyLock does not receive your Google password. Access is used so the extension can read and write the encrypted file on your Drive. Google’s own privacy policy covers processing on Google’s side.
You can revoke access in your Google account settings. The extension then loses the ability to sync.
What we do not do
- We do not run a server that stores your vault.
- We do not sell data, and the extension does not show ads.
- We cannot reset your master password.
This website
The marketing site is static. It does not use analytics cookies and does not embed tracking tools. The server that hosts the site may see ordinary request logs, such as an IP address, as most websites do.
Your choices
Remove the vault by deleting the encrypted file from your Google Drive and removing the extension from the browser. Because we do not have the master password, we cannot restore it.
Changes
If this policy changes, the date on this page is updated. Related document: Terms of Use.