Privacy Policy

1. Who is responsible

Novash is operated by Abdulrahman Elmahdi Ramadan Rabia, an individual developer (sole trader). In this policy, "Novash," "we," and "us" mean Abdulrahman Elmahdi Ramadan Rabia, who is the controller of your personal data.

Abdulrahman Elmahdi Ramadan Rabia
East side of Shiha, near NH Center, Derna, Libya
Phone: +218 91 230 0330
Privacy, access, and deletion: support@novash.app
Security reports: security@novash.app

The same details are on our Legal Notice. We have not appointed a data-protection officer. We have not yet appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or the UK GDPR. When we do, their name and contact details will appear here and on the Legal Notice. Until then, write to support@novash.app with any privacy request.

2. What this policy covers

This policy covers the Novash app for iPhone and iPad (including its AutoFill extension), the account and sync service behind it, and this website, novash.app. It explains what personal data we process, why, who helps us, how long we keep it, and the choices you have.

3. Your vault

Everything you save in your vault is encrypted on your device with AES-256-GCM before it is uploaded. This includes item names, usernames, passwords, websites, notes, authenticator secrets, custom fields, cards, identities, SSH keys, passkeys, and folder names. The key that encrypts your vault is protected by a key derived from your master password with Argon2id. We store and sync only the encrypted copy, and we cannot read it.

Your master password never leaves your device. To sign you in, your device derives a separate sign-in secret from it, and our server stores only a one-way hash of that secret. Your vault key is stored on our server only in wrapped form, which your master password or your recovery key can open. We also store a recovery check that confirms a recovery key is correct without revealing it.

What is not encrypted

To sort, sync, and show your vault, a few details about each item are stored without encryption: its type (for example login, card, or note), the icon you chose for it (which may show a brand, such as a website's logo), the folder it belongs to, whether it is a favorite, its position in a list, and when it was created and last changed. These details never include your passwords, usernames, websites, or notes.

When AutoFill is on, the app also gives iOS the username and website of each login and passkey, so iOS can suggest them above the keyboard and in the sign-in sheet. iOS keeps this list on your device, and it never includes your passwords.

Encrypted data is still personal data under privacy law, because it is linked to your account. We treat it that way.

4. Other data we process

Account

Your email address, the hashed sign-in secret described above, the settings you choose in the app (such as language and notifications), and the records needed to keep you signed in. If you turn on an authenticator app for signing in to Novash, we store what is needed to check its codes.

Devices and activity history

A list of the devices signed in to your account (a device ID, the device name and model, and when it was last seen), so your vault can sync and you can sign a device out. Your activity history in the app records events such as sign-ins, new devices, and vault changes. The type of each event, its time, and the device are stored as plain data so the list can be shown and kept to size. The details of each event are encrypted. An event may also include an IP address or an approximate location, to show you where a sign-in came from.

Subscription

Apple sells the subscription and handles payment. We never receive your card details. RevenueCat receives your purchase records from Apple, linked to a random account ID (not your email address), and tells the app whether your subscription is active.

Emails we send you

We send verification codes, for example when you sign up, sign in, recover your account, or change your email, and security alerts, such as a sign-in on a new device or a vault restored with your recovery key. These go to your email address and may name the device involved.

Notifications

If you allow notifications, your device receives a push token that we use to send you alerts. You can turn notifications off at any time in your device settings.

Crash reports

If the app crashes or hits a serious error, it sends a crash report: the error, the app and system version, the device model, and an installation ID. Crash reports never contain your vault. The advertising and analytics features of this tool are switched off.

Feedback and support

If you send feedback in the app, we receive the topic and message you write, linked to your account. If you email us, we keep your message and address so we can reply. Please never send us your master password or recovery key. We will never ask for them.

Breach check

When you check whether a password has appeared in a known data breach, the password never leaves your device. Only the first five characters of its SHA-1 hash are sent to Have I Been Pwned, and the match is finished on your device. The check runs only when you start it.

Abuse protection

To stop automated attacks, Cloudflare Turnstile checks that a real person is using the app when you sign up, sign in, recover your account, or change your email address. To limit repeated attempts, we briefly keep your IP address and the email address used in short-lived counters.

This website

The website has no accounts, no forms, no analytics, and no advertising. Our hosting provider, Cloudflare, processes your IP address and basic request data to deliver and protect the site. See our Cookie Notice.

5. Why we use it

Where the GDPR or a similar law applies, we rely on these legal bases:

• Contract (Art. 6(1)(b)): to create your account, store and sync your encrypted vault, sign you in, send the codes you need, and check your subscription.
• Legitimate interests (Art. 6(1)(f)): to keep accounts and the service secure, stop abuse, fix crashes, send security alerts, and answer feedback. We have weighed these interests against your rights.
• Consent (Art. 6(1)(a)): for notifications, which your device asks you to allow. You can withdraw consent in your device settings at any time.
• Legal obligation (Art. 6(1)(c)): where a law requires us to keep or disclose information.

We do not sell personal data. We do not share it for advertising, we do not track you across other companies' apps or websites, and we do not make automated decisions about you that have legal effects.

6. Who helps us

A small number of service providers process data for us, only to run Novash and only under our instructions: Supabase (database and sign-in, hosted in Frankfurt, Germany), Apple (app distribution, payment, and push delivery), RevenueCat (subscription status), Zoho ZeptoMail (email delivery), Cloudflare (bot checks and website hosting), Google Firebase (notifications and crash reports), Have I Been Pwned (breach check), and Slack (receiving in-app feedback). The full list, with what each one receives and where, is on our Service Providers page.

Some of these providers process data outside your country, including in the United States. Where European law requires a safeguard for such a transfer, we rely on the one the provider offers for its service, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. You can ask us for details at support@novash.app.

We disclose data to authorities only when the law requires it. Our vault encryption means we cannot hand over readable vault contents. See Law Enforcement Requests.

7. How long we keep it

• Account and vault: for as long as your account exists.
• After you delete your account: your account and everything stored with it on our servers are permanently erased 30 days later. Until then you can sign in and cancel. Purchase records held by Apple and RevenueCat follow their own retention rules. See Delete Your Account.
• Activity history: the newest 50 entries of each list. Security records, such as a new device or a master password change, are kept for 180 days.
• Email codes: deleted about one day after they expire.
• Abuse-protection counters: deleted within two days.
• Backups and crash reports: removed on the normal cycle of those systems, within about 90 days.
• Support emails: kept as long as needed to help you and handle any follow-up, and no longer than 24 months, unless the law requires us to keep them longer.

8. How we protect it

Your vault is encrypted on your device before it syncs, so our servers hold only the encrypted copy. All traffic uses HTTPS. Database rules keep each account's data separate. New sign-ins need a second step: a code sent to your email, or a code from an authenticator app. We keep improving these protections. If a personal-data breach happens that the law requires us to report, we will tell the authorities and the people affected as the law requires. Under the GDPR, that means telling the supervisory authority within 72 hours of becoming aware of it, where notification is required.

Because only you hold your master password and recovery key, we cannot recover your vault if you lose both. Keep your recovery key somewhere safe, outside the vault.

9. Your rights

Depending on where you live, you can ask to access, correct, delete, or restrict your personal data, to get a copy of data you gave us in a portable format, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You can also delete your account yourself in the app, and export your vault before you do.

To use a right, email support@novash.app. We may need to confirm the request comes from you, but we will never ask for your master password or recovery key. We reply within the time the law sets, which is one month under the GDPR. You also have the right to complain to a data-protection authority, especially in the country where you live or work.

If a U.S. state privacy law applies to you, you can use the same address to exercise the rights it gives you. We will not treat you differently for doing so.

10. Children

Novash is not directed to children. We do not knowingly create accounts for children under 16 in the European Economic Area and the United Kingdom, or under 13 anywhere else. If you believe a child has an account, email support@novash.app and we will delete it.

11. Changes to this policy

When this policy changes, we update the date at the top. If a change is important, we will also tell you in the app or by email before it takes effect.

12. Contact

Abdulrahman Elmahdi Ramadan Rabia, operating Novash
East side of Shiha, near NH Center, Derna, Libya
Phone: +218 91 230 0330
Privacy, access, and deletion: support@novash.app
Security reports: security@novash.app