Privacy Policy
Updated: May 14, 2026
This Privacy Policy describes the technical measures SecBoss employs to ensure your data remains private.
SecBoss is a customizable, local-first, zero-knowledge secure notes app. We collect the minimum information needed for authentication, and provide a secure conduit for manual multi-device sync and record sharing — without ever gaining access to your notes.
1. Information We Collect & Process
We practice strict data minimization. Account creation requires only three things: your email address, a username, and a password.
We practice strict data minimization. Account creation requires only three things: your email address, a username, and a password.
- Email Address: Collected for account authentication, unique identification, and to maintain your subscription record.
- Username: Collected for account identification and to maintain your subscription record.
- Password: Used to authenticate you to our servers. Your master password — used to encrypt and decrypt your notes — is separate, stays on your device, and is never transmitted to or stored by us.
- Secret Key & Recovery Phrase: Generated on your device at account creation and shown to you once. We do not transmit, store, or retain a copy — safekeeping is entirely your responsibility.
2. Notes, Templates & Custom Structures
SecBoss lets you build your own note records using custom fields and templates that you design.
SecBoss lets you build your own note records using custom fields and templates that you design.
- We Don't Know Your Structure: Because you create your own templates and note structures, we have no knowledge of how your data is organized or what it contains.
- Encrypted Records: Every note record is encrypted on your device before it is ever written to disk or transmitted anywhere.
- Unrecoverable by Design: Your notes exist only on your device. If your device is lost, wiped, or its local data deleted, that data cannot be recovered — by you or by us.
3. Manual Sync & Sharing
To move data between devices or people, SecBoss relies on transiting encrypted data through our servers rather than storing it there.
To move data between devices or people, SecBoss relies on transiting encrypted data through our servers rather than storing it there.
- Manual Device Sync: When you choose to sync notes to another of your devices, your encrypted database is transmitted as disposable data and is immediately deleted upon receipt.
- Record Sharing: You may share individual records with other users, online or offline. Shared data remains encrypted in transit and is not retained by us after delivery.
- No Long-Term Storage: We do not keep permanent copies of your notes, synced data, or shared records on our servers.
4. Data Encryption & Zero-Access Architecture
SecBoss utilizes a "Zero-Knowledge" security model for your sensitive information.
SecBoss utilizes a "Zero-Knowledge" security model for your sensitive information.
- End-to-End Encryption: Your vault is encrypted locally using your master password before it ever leaves your device for syncing or sharing.
- No Server-Side Keys: We do not hold your master password, secret key, or encryption keys. Consequently, even while your data is in transit through our servers, it remains an unreadable "ciphertext" that we cannot decrypt.
- Local Sovereignty: Your primary database remains on your hardware.
5. Remote Data Wipe
SecBoss provides a remote wipe feature so you can erase your local data if a device is lost or stolen. Because this feature acts on your device's local data, once a wipe is executed the data is unrecoverable — by you or by us.
SecBoss provides a remote wipe feature so you can erase your local data if a device is lost or stolen. Because this feature acts on your device's local data, once a wipe is executed the data is unrecoverable — by you or by us.
6. How We Use Your Email & Username
Your email address and username are used strictly for:
Your email address and username are used strictly for:
- Authentication: Verifying your identity during login and sync/share authorization.
- Subscription Records: Maintaining your account and subscription status.
- Support: Responding to technical inquiries or bug reports you submit.
- Security Notifications: Informing you of critical security updates.
7. Device Permissions Disclosure
To provide functionality, SecBoss requests the following system-level permissions:
To provide functionality, SecBoss requests the following system-level permissions:
- Biometric Hardware: To facilitate local unlocking. The app receives a "success/fail" token from the OS; it never sees or stores your actual biometric data.
- Network Access: Required to facilitate manual sync, record sharing, and to check for software updates.
- File System Access: Required to manage the encrypted database file locally on your device.
- Camera Access: Required for QR scanning purposes.
- Location Access (Bluetooth): Required for offline sharing with nearby devices.
- Push Notifications: Required to inform you of important updates and alerts.
8. Data Retention & Your Rights
- Account Deletion: You may request the deletion of your account, username, and email from our authentication records.
- Transient Data: Encrypted sync and share packets are deleted immediately upon receipt or after the transfer window expires.
- Data Erasure: You exercise the "Right to Erasure" at any time by using the remote wipe feature, or by deleting the app or database file from your device.
9. Compliance
We handle your information in accordance with the Philippine Data Privacy Act of 2012 and align our practices with international data protection standards, including principles set out in the GDPR and other applicable global privacy frameworks. We do not sell, rent, or share your email, username, or your encrypted traffic with third-party advertisers or data brokers.
We handle your information in accordance with the Philippine Data Privacy Act of 2012 and align our practices with international data protection standards, including principles set out in the GDPR and other applicable global privacy frameworks. We do not sell, rent, or share your email, username, or your encrypted traffic with third-party advertisers or data brokers.