Privacy Policy

Data used by the app

The app uses the site address and password you enter to calculate the original PwdHash result on your Android device. The app does not send your inputs or generated passwords to the developer or to a server.

The app has no user accounts, analytics, advertising SDKs, tracking, or cloud sync. The app does not automatically upload credentials. The app does not automatically upload usage information. The app does not automatically upload session data.

No network connections or wireless communication

• The app does not request Android’s android.permission.INTERNET permission.
• The app does not open network sockets.
• The app does not make HTTP or HTTPS requests.
• The app does not call remote APIs.
• The app does not connect to servers.
• The app does not run background network services.

The app does not use Wi-Fi to communicate. The app does not use cellular or mobile data, including 4G/LTE and 5G, to communicate. The app does not use Bluetooth to communicate. The app does not discover nearby devices. The app does not scan wireless networks. The app does not inspect network status.

Entering a site address or URL is only an input to local calculation. The app does not visit the entered website. The app does not look up its address through DNS. The app does not contact that website. The app does not sign in to your accounts. The app does not change your accounts.

Optional links hand off to the browser or email app only when tapped, as described below.

No saved user files or password history

The app keeps only the current session in memory. The app does not write your site addresses, input passwords, generated results, or session history to files, logs, databases, shared preferences, or the Android Keystore.

The app does not export credential files. The app does not create credential backups. The app does not save inputs for state restoration. Backup and app-data transfer are disabled in the app configuration. Process or activity recreation starts with empty inputs.

The Clear when leaving app setting is temporary and starts enabled on a new session. Choosing Copy places a result on Android’s system clipboard, as described separately below.

Session retention and clearing

Clear when leaving app is enabled by default and clears the fields when the app enters the background. You can turn it off to reuse the inputs while switching apps.

Five minutes without interaction expires the session. An expired session is cleared before it can be used again. Android may pause a background process; with background clearing switched off, expiry is enforced when the app next runs, without a guarantee of erasure at exactly five minutes while suspended.

Clear removes the current fields and generated result. It also removes an app-owned clipboard copy when Android allows clipboard access and the app still owns that copy. The app overwrites temporary input buffers where possible. Java, Android, keyboards, and the operating system manage other memory copies; clearing does not guarantee that every physical byte has been overwritten.

There is no app account or server-side password record to delete.

Android clipboard

When you tap Copy, the app places the generated result on Android’s clipboard and marks it as sensitive content. The app sets a 60-second cleanup deadline and clears its expired copy while it is active and has focus. It checks again when you return.

Android restricts background clipboard access and controls its own automatic clipboard expiry. PwdHash cannot guarantee that its copied item is removed at exactly 60 seconds while the app is in the background. Another app’s newer copy is preserved.

Leaving the app clears its fields by default but keeps your intentional copy available to paste. Android and your device settings control clipboard access by other apps or system features. Copies you paste into another app are handled by that app.

Screen and keyboard privacy

The app enables Android’s secure-window protection to block ordinary screenshots and screen recording of its contents. Password fields start hidden and are revealed only while you hold an eye button.

Password and private-input flags request that the keyboard avoid personalised learning and suggestions. Android and the user control the selected keyboard and its own privacy practices.

External links and support email

The original-project link opens your external browser only when you tap it. Contact opens your email app with the support recipient filled in. The app does not attach your entered site address, input password, or generated result to those links. The app does not send support messages automatically.

Your browser, email app, Google Play, and their providers may use network connections and process information under their own privacy policies. Those services are not required for offline password generation after installation.

If you email support, the developer receives your sender address, message, and information you choose to include. Email providers handle delivery. This correspondence is used to respond to your request. Please use example inputs and do not send real passwords. Contact the developer if you have a privacy question or wish to request deletion of a message you sent.

Volunteering as a tester

Volunteering is optional. Joining the PwdHash Android tester Google Group uses your Google account. Google manages membership, and group owners can access the membership information Google provides, such as your display name and email address, to manage the test and communicate about it.

For a closed test configured to use this group, Google Play uses membership to determine eligibility. Joining the group does not automatically opt you into the test. You must also accept the Google Play opt-in invitation. Google handles its accounts, groups, opt-in pages, distribution, and testing services under Google’s privacy policy.

Posting feedback in the group is optional. Your posts and author information are visible according to the group’s settings. You can also send feedback or ask for help by email; the developer receives your sender address, message, and any details you choose to include, for handling that request.

You can leave the group through Google Groups and leave the test separately through Google Play. You can also contact the developer to request removal from the group or deletion of correspondence. These voluntary group, email, and Google Play activities are separate from the app’s offline handling of passwords.

This website

Cloudflare hosts nmic.app and processes ordinary connection and request information, such as your IP address and requested URL, to serve and protect the website. See Cloudflare’s privacy policy.

The website does not include advertising or analytics scripts. The website does not ask you to enter passwords. Email addresses are revealed only after a visitor activates a contact button. This is basic anti-scraping protection, not a guarantee that a public address cannot be recovered.

Policy updates

Changes will be published at this URL with an updated date.