Privacy Policy

wljpassmgr (“we”, “us” or “our”) is an end-to-end encrypted password management service that helps you securely store, organize, retrieve and manage passwords, secret notes and encrypted images, with optional encrypted cross-device sync.

App operator: Beijing Weilingji Technology Co., Ltd.

App developer: Beijing Weilingji Technology Co., Ltd.

The operator and the developer named above are the same legal entity (together referred to as “we”, “us” or “our company”), and are the personal information processor under this Policy. You may contact us using the methods listed in Section 13 of this Policy.

This Privacy Policy (the “Policy”) explains how we handle information when you use wljpassmgr products and services, the security measures we take, and the rights you have.

This Policy applies to the wljpassmgr apps (iOS / Android / desktop), browser extension, official website and related services we operate.

Enterprise applications and contracts. When you submit an enterprise application, we process the company name, Unified Social Credit Code, contact name, phone, email, expected seats and notes you provide to contact you and follow up. After contracting, we also process contract references, receiving accounts, organization IDs, plans, seats, terms, contract and received amounts, receipt times, bank transaction references, invoicing details and operation records to perform the contract, verify corporate bank transfers, issue entitlements and handle invoicing. Enterprise applications do not invoke WeChat or Alipay payment SDKs. Authorized staff process this information according to their duties, retaining it for the purposes above and applicable legal obligations. You may contact us under this policy to request access, correction, application withdrawal or deletion, except for contract and financial records that must be retained by law. Do not include passwords, private keys or bank login credentials in an application.

1. Your data is encrypted by you — our servers only ever see ciphertext. Your vault, secret notes, encrypted images and other core data are encrypted locally on your device. Even when you enable cross-device sync, only ciphertext is uploaded to and stored on our servers; we technically cannot read your plaintext.

2. Account information (only when you actively use it). Only when you choose to register an account and enable cross-device sync do we process the minimum information required to provide that feature, such as a registration email or username and the security credentials used for authentication (never your plaintext master password).

3. Necessary service information. When you use features that require network access (such as sync or update checks), we may process limited technical information such as device model, OS version and network status, solely to keep the service running securely.

4. What we explicitly do not collect. We do not collect your plaintext passwords, the content of your secret notes, or the content of your encrypted images. We do not collect your browsing history or web page contents, we do not build advertising-oriented behavioral profiles, and we do not serve behaviorally targeted advertising.

5. Advertising identifier stripped out. At build time we remove the advertising-identifier related permissions (Android `AD_ID`, `freemme.permission.msa`) and disable the advertising-identifier collection flag. We do not integrate advertising or analytics SDKs or use device identifiers for advertising tracking or profiling. The information processed by payment SDKs for transactions and security checks, and their applicable rules, are described in the SDK details below.

6. Device identifiers (device SN / serial number). When you use features such as cross-device sync, device management, sign-in verification and your private cloud gallery, we read device identifier information through standard system interfaces (Android `Build` information, iOS `identifierForVendor`) — including device brand, model, OS version and the device identifier / device serial number (together, “device SN”) — in order to identify the device, protect your account and prevent misuse from unknown devices. On some Android devices (including Huawei devices), the device identifier exposed by the system is based on the device serial number (SN). The device SN is used only for the device identification and security verification purposes described above, and is never used for advertising, profiling or any other commercial purpose.

7. Membership orders and payment information. When you purchase or renew membership, we process account-linked order numbers, plans, payment channels, amounts, order creation and payment times, transaction identifiers, payment status, and refund requests and results. We use this information to create orders, verify payments, grant membership benefits, provide order queries, process refunds, reconcile transactions and prevent fraud. Payment is completed in the WeChat or Alipay cashier. This app does not read or store your bank card number, payment account password or SMS payment verification code. You may choose not to pay; this does not invoke the payment SDK or affect password management within your current entitlements.

Except for normal permissions such as internet access, network state and Wi-Fi state, which the system grants automatically after installation, permissions are requested on demand when you actually use the corresponding feature, never silently in the background. You may turn off permissions requiring authorization in your system settings at any time; disabling one permission only affects the corresponding feature and does not affect the others.

(1) Android permissions.

• `INTERNET`: used for features that require network access such as registration and sign-in, encrypted data sync and update checks. A normal permission granted automatically after installation.
• `ACCESS_NETWORK_STATE`: used to determine whether the network is available, so we can warn about failed sync or a network switch. A normal permission granted automatically after installation.
• `ACCESS_WIFI_STATE` (Wi-Fi state): used by the Alipay payment SDK for payment connectivity and security checks. This is a normal permission and does not expose vault contents.
• `USE_BIOMETRIC`: invoked only when you actively enable fingerprint / face unlock, through your device's local biometric capability. Biometric data always stays in the device's local secure area; we do not collect it, do not upload it and cannot access it.
• `CAMERA`: invoked only when you actively use scanning features such as importing a private key by QR code or scanning a backup QR code. You may deny it and enter the data manually or import from your photo library instead.
• `READ_MEDIA_IMAGES` / `READ_EXTERNAL_STORAGE` / `WRITE_EXTERNAL_STORAGE` (photos / storage, requested only on Android 13 and below and older versions): used to save private key backup images and backup cards to your photo library, and to pick an avatar or image from it. We only access files you actively select or authorize and never read other content in your photo library.
• `POST_NOTIFICATIONS`: used only when you enable necessary notifications such as backup reminders, to send service notices directly related to account security (private key backup expiry reminders, account security alerts). It is not used for advertising or personalized push. You may turn the notification permission off at any time.
• `SCHEDULE_EXACT_ALARM`: used to trigger local scheduled tasks such as backup reminders at the time you set, and takes effect locally only.
• `REQUEST_INSTALL_PACKAGES`: used to download and install app updates inside the app (Android only). The installation is always confirmed by you in the system UI.

(2) iOS permissions.

• Camera (NSCameraUsageDescription): used to scan QR codes to import a private key and to recognize backup QR codes.
• Face ID (NSFaceIDUsageDescription): used for face unlock. Biometrics are performed locally by the system and we cannot access your face data.
• Photo library read / add (NSPhotoLibraryUsageDescription / NSPhotoLibraryAddUsageDescription): used to import images from your photo library and to save private key backup images to it.
• Notifications: used to send necessary service notices such as backup reminders and account security alerts, never for advertising or personalized push.

1. Encrypted at rest. All sensitive data is encrypted with AES-256 before being written to storage. On mobile, key material is kept in the system secure storage (SecureStorage / Keychain); on desktop and browser, equivalent local secure-storage mechanisms are used.

2. Key separation. We use an architecture that separates data-encryption keys from authentication keys. Your master password is used only to derive keys locally on your device; it never leaves your device and is never uploaded.

3. Zero-knowledge architecture. Data synced to our servers is always ciphertext. Encryption and decryption happen only on your devices, and the keys required for decryption are held exclusively by you: our servers merely host ciphertext and, by design, have no capability to recover your plaintext. Key material is also kept in encrypted form at all times.

4. Biometrics stay on-device. Fingerprint and face recognition are performed locally through your device's built-in security capabilities. Biometric data never leaves your device and is not accessible to us.

5. Private key and backup kit. The plaintext of your private key (Secret Key) is handled only in your device's memory: it is never uploaded to our servers, written into the URL, stored in localStorage / IndexedDB / cookies, or written to logs or analytics events. To support device management (avoiding repeated entry and validating new devices), an encrypted device key may be stored locally; it is derived from your master password using PBKDF2-HMAC-SHA256 (210,000 iterations) and encrypted with AES-GCM-256, so it can only be unlocked with your master password and cannot be decrypted by our servers. Any backup artifact you export from the app, the website or the browser extension (image, PDF or QR code) is equivalent to the private key itself — keep it offline. If the private key is lost, we cannot recover or reset it, and failing to back it up may permanently lock you out of your account and data.

6. Retention of order records. Membership orders and payment and refund records are business information needed to provide the service. They are separate from vault ciphertext that only you can decrypt. We retain these records for the period necessary to provide membership services, handle refunds or transaction disputes, and fulfil financial and legal obligations, with restricted access. After account closure, transaction records required by law are retained only within the necessary scope and period and are not used for other purposes. Once the retention basis and necessary period end, we delete or anonymize them as required by law.

1. No sharing by default. We do not sell or rent your personal information, or provide it to third parties for advertising, marketing or purposes unrelated to the services you use. We do not integrate advertising SDKs, and we do not provide third parties with your vault contents, secret notes or encrypted images.

2. Payment-related sharing and third-party SDKs. When you choose WeChat Pay or Alipay, we send the selected payment provider the order number, product description, payment amount and signed parameters necessary to complete the transaction. We receive results such as transaction identifiers and payment or refund status to verify transactions and provide membership services. Our Android client uses WeChat OpenSDK to open WeChat Pay and the Alipay client payment SDK to open the Alipay app. WeChat Pay is provided by Tenpay Payment Technology Co., Ltd., and Alipay payment is provided by Alipay (China) Network Technology Co., Ltd. Section 2 lists the SDK provider, when it is invoked, the information involved and its personal information processing rules. Payment providers do not receive your vault contents, secret notes, encrypted images, master passwords or decryption keys.

3. Limited exceptions. We may disclose necessary information only in the following circumstances: (a) with your explicit consent; (b) where required by applicable laws, regulations or binding orders from judicial or administrative authorities; or (c) where necessary in an emergency to protect your or another person's life or property.

4. Business transitions. In the event of a merger, acquisition or reorganization, we will require the receiving party to continue to honor this Policy, or seek your consent before transferring data.

1. Encrypted in transit, end-to-end protected. We communicate over encrypted channels (HTTPS/TLS). Sensitive data is end-to-end encrypted before it leaves your device; the cloud stores only ciphertext, and the decryption keys remain exclusively in your hands.

2. Least-privilege design. We request only the permissions necessary for core features — no unnecessary system access, no silent background reporting.

3. Security engineering practices. We employ auto-lock, configurable session timeouts, log redaction in production, code obfuscation and a security-aware development process to continuously reduce exposure.

4. Incident response. If an event occurs that may affect the security of your data, we will notify you and the relevant authorities in a timely manner as required by applicable law.

1. Access and correction. You can view and edit your vault contents and profile information at any time within the app.

2. Export. We provide data export capabilities so you can take your data with you in a readable format at any time. Your data sovereignty is always yours.

3. Deletion and account closure. You can delete local data or close your account. For the detailed process, time limits and consequences, see Section 8 “Account Closure” of this Policy.

4. Withdrawing consent and complaints. You may withdraw any authorization you have granted at any time and file a complaint with us or the competent regulatory authority.

5. Response time. We process requests in accordance with applicable law (including, without limitation, the PRC Personal Information Protection Law and the GDPR), and typically respond within 15 business days of receiving a request.

Our app provides account registration and sign-in, so you have the right to close your account at any time. We provide the following closure channels:

1. Self-service in the app (recommended). After signing in, go to 「Me / Profile → Account & Security → Close Account」 and follow the on-screen steps to complete identity verification (email code / SMS code; dual verification is required when both channels are bound), then submit your closure request.

2. Request closure via our support email. If you cannot sign in, send a closure request from your registered email address to passgmr@weilingji.com with the subject “Account Closure Request”, including your account (registered email or phone number). After verifying your identity, we will complete the closure within 15 business days.

3. Assistance via our official website. You may also visit https://www.passmgr.com/ to obtain our contact details and ask us to assist with the closure.

Rules and consequences of closure:

• Data handling. Once closure is complete, we will delete or anonymize the personal information associated with your account (including account profile, cloud-synced ciphertext and backup records), except where retention is required by applicable law or to fulfil our legal obligations.
• Local data. Vault data stored locally on your device must be removed by you in the app or by uninstalling the app; under our zero-knowledge architecture we cannot remotely access or delete plaintext data on your device.
• Cooling-off period and re-registration. After closure you will not be able to re-register with the same email / phone number for 15 days, after which re-registration becomes available.
• Irreversibility. Closure is irreversible. After closure your account data and cloud-synced ciphertext will be deleted and cannot be recovered. Please export or back up your data using the in-app functions before closing your account.
• Time limits. In-app self-service closure takes effect immediately; requests submitted via the support email are processed within 15 business days after we verify your identity.

1. We do not offer personalized recommendations or targeted push. wljpassmgr is a password manager: we do not provide personalized content recommendations based on user profiles, and we do not carry out targeted or advertising push. We do not push goods, services or advertising based on your usage behavior.

2. Necessary notices we may send you. Only in the following scenarios directly related to your account security or service operation may we send necessary in-app notices or service notifications, such as: private key backup reminders, account security alerts (abnormal sign-in, changes to verification methods), account lock and unlock notices, and service change or shutdown announcements. These notices are not advertising or personalized push; their purpose is to protect the security of your account and data.

3. How to turn notifications off or adjust them. You may turn off private key backup reminders at any time under 「Me / Profile → General Settings → Backup Reminder」, or disable this app's notification permission in your device system settings to stop receiving push notifications. Turning these off does not affect your use of the core features of the Service.

4. Email and SMS. To complete identity verification (registration, sign-in, password change, account closure) we send verification codes to your registered email address or phone number. Such messages are a necessary prerequisite for using the corresponding features and cannot be turned off.

1. Official website. Our official website does not use tracking cookies and does not integrate third-party ad tracking. Where local preferences are used, they rely on browser local storage only, and the data never leaves your browser.

2. Client apps. wljpassmgr stores encrypted data and preferences in your device's local secure storage (e.g. IndexedDB, SecureStorage, Keychain). You control this data and can clear it at any time.

3. Your choice. You may clear local data on your device at any time. Please make sure you have a proper backup first: under our zero-knowledge architecture, we cannot recover it for you.

We take the protection of children's personal information very seriously. Our services are intended for the general public and we do not knowingly collect personal information from children under the age of 14, nor do we carry out personalized recommendations or targeted push aimed at children under 14.

1. Rules for handling the personal information of children under 14. If you are under 14, please read this Policy together with your parent or guardian, and use our services only after obtaining their consent. Guardians should guide minors in using this service and keep their account and master password safe.

2. We do not knowingly collect children's personal information. Our registration and sign-in flows are not designed for children and do not proactively ask children to provide personal information. If, in the course of providing the service, we discover — or a guardian informs us — that we have collected the personal information of a child under 14 without prior verifiable parental consent, we will immediately stop processing it and delete the relevant personal information as soon as possible after verification.

3. How guardians can manage a child's information. If you are the guardian of a minor and wish to access, correct or delete the minor's personal information, or withdraw consent, please contact us using the details in Section 13 of this Policy. After verifying your status as guardian, we will handle your request within 15 business days.

4. Minors under 18. If you are under 18, please use this service with the consent and guidance of your guardian. We advise minors not to use this service to store sensitive credentials belonging to their guardians or others.

We may revise this Policy from time to time. For material changes, we will notify you in advance through reasonable means such as in-app announcements or notices on our website, and publish the updated version and effective date on this page.

The revised Policy takes effect upon publication. Your continued use of our services after the Policy is updated constitutes acceptance of the updated Policy.