Last updated: February 17, 2025
Effective from: July 4, 2025
This Privacy Notice for Starpass Generator ("we," "us," or "our"), an open-source, not-for-profit web application, explains how we handle your information when you use our services ("Services"), including when you:
Starpass’s zero-knowledge architecture ensures we collect no personal information unless you voluntarily provide it (e.g., via support requests). If you do not agree with our policies, please refrain from using our Services. For inquiries, contact us at contact@samin-yasar.dev.
In Short: Starpass collects no personal information during normal use; only support requests may include voluntarily provided data.
Starpass generates passwords, passphrases, and usernames locally in your browser or PWA, without accounts or external storage. No personal information (e.g., name, email, IP address) is collected during generation or strength analysis. If you contact us for support, you may voluntarily provide details (e.g., email, message), which we collect solely to respond.
Starpass does not process sensitive personal information (e.g., health data under HIPAA, financial details) during generation. If you include sensitive information in support requests, it is processed only to address your query and not retained beyond response.
Starpass does not fetch third-party data (e.g., APIs) for its core functionality. All word lists and generation logic are embedded locally in the application.
In Short: All processing is local; support requests involve minimal server communication.
Starpass processes all generation (passwords, passphrases, usernames) and strength analysis locally in your browser or PWA. No data is transmitted unless you submit a support request, in which case your provided details (e.g., email, message) are sent securely to our server for response.
In Short: Local processing requires no legal basis; support requests rely on consent (GDPR Art. 6(1)(a)).
Starpass’s zero-knowledge architecture ensures no personal data is collected during generation, requiring no legal basis under GDPR or similar laws. For support requests, we process data based on your explicit consent, provided during submission, in compliance with GDPR, UK GDPR, and other applicable laws.
In Short: No data is shared except for support request details sent to our server.
Generated passwords, passphrases, usernames, and analysis data remain local and are not shared. Support request data (e.g., email, message) is sent to our server for response. No data is shared with third parties, business partners, or in business transfers, per our zero-knowledge principle and SOC 2 confidentiality controls.
In Short: Local data persists until cleared; support request data is retained only as needed.
Generated data and cached PWA content remain in your browser’s local storage until cleared via Starpass’s interface or browser/PWA settings. Support request data is retained on our server only for the time necessary to respond, typically no longer than 30 days, unless required for legal purposes, per GDPR and SOC 2 requirements.
In Short: Local data is secured by your device; support request data is protected with robust measures.
Local data (generated credentials, cached PWA data) is protected by your device’s and browser’s security features (e.g., encryption, access controls). Support request data is transmitted via HTTPS, stored with AES-256 encryption, and access is restricted to authorized personnel. We implement SOC 2 and CSA-compliant controls (e.g., access logs, audits). If health data is included in requests, HIPAA-compliant safeguards (e.g., minimal use, breach notification) apply. In case of a breach, we will notify affected users and regulators as required by GDPR, HIPAA, and CCPA.
In Short: You control local data; support request data rights are exercisable by contacting us.
Under GDPR, you have rights to access, rectify, delete, restrict, or port your data, applicable to support request data. You control local data via Starpass’s interface (e.g., clear cached data) or browser/PWA settings. For support request data, contact us to exercise rights. CCPA grants California residents similar rights, including opting out of data sales (not applicable, as we do not sell data).
Starpass does not use cookies, trackers, or analytics, so Do-Not-Track signals are irrelevant. For California residents, we comply with CCPA and the "Shine The Light" law by not sharing data for marketing.
In Short: CCPA and state laws apply minimally, but you control your data.
Starpass collects minimal personal information. The following table outlines CCPA categories:
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email, IP address | YES (Only optional email in support requests) |
| B. Personal information | Name, contact, financial details | YES (Only if in support request message) |
| C. Protected characteristics | Gender, age, race | NO |
| D. Commercial information | Transaction details | NO |
| E. Biometric information | Fingerprints, voiceprints | NO |
| F. Internet activity | Browsing history | NO |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory | Images, video | NO |
| I. Professional information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences | Profiles | NO |
| L. Sensitive personal information | Financial data, IDs, health data | NO |
Contact us to exercise CCPA rights (e.g., access, deletion).
In Short: Region-specific rights are limited but supported.
For Australia (Privacy Act 1988), New Zealand (Privacy Act 2020), and South Africa (POPIA), Starpass complies via minimal data collection and user controls. Contact us to exercise rights or file complaints with:
Starpass’s core features (password, passphrase, username generation, strength analysis) use a zero-knowledge architecture, ensuring no data is collected or stored by us, except for support requests.
All functionality is executed locally in your browser or PWA. No third-party API calls are made. Support requests involve secure server communication, limited to provided details (e.g., email, message).
Starpass does not use cookies, tracking pixels, or analytics, ensuring an anonymous experience except for voluntary support requests.
In Short: Yes, we may update this notice.
Updates will be indicated by a revised date. Significant changes will be communicated via the app or GitHub repository. Review periodically to stay informed.
Contact us at:
Email: contact@samin-yasar.dev
Post:
Samin Yasar
Starpass Generator Developer
Dhaka, Bangladesh
GitHub: https://github.com/Samin-yasar/Starpass
Manage local data via Starpass’s interface (e.g., clear cached data) or browser/PWA settings. For support request data, contact us at contact@samin-yasar.dev to request access, correction, or deletion.