Privacy Policy

Zero-knowledge by design

OBANO is a local-first password manager. Your vault — every platform name, username, password, and note — is encrypted with AES-256-GCM and stored in your device's local IndexedDB storage. The master key is derived from your master password and held in memory for the duration of an unlocked session only. It is never written to disk and never transmitted.

What OBANO never does

• Never sends your passwords, usernames, or vault contents over the network.
• Never stores your master password — the verifier is an encrypted digest only.
• Never runs telemetry on your vault data.
• Requires no account, no email, no registration.

Local data

Vault data lives in your browser's IndexedDB inside the OBANO application profile (e.g. %APPDATA%\obano on Windows). Deleting the application or its profile removes your vault entries. Keep a backup of your master password — OBANO cannot recover it, by design.

Security mechanisms

Security events — failed unlock attempts, clipboard wipes, audit scans — are processed locally by the watchdog system. The 5-strike circuit breaker persists across restarts to defend against brute-force attempts.

Contact

Questions about this policy can be directed to the OBANO project maintainers.