Legal
Privacy notice
What personal data remempass.org and the Remem sync service process, why, for how long, who helps us, and how to use your rights. Your vault itself is end-to-end encrypted: we cannot read it.
Effective 21 October 2026 · Version 2026-10-21
Who is responsible
The controller of your personal data is the operator of remempass.org:
Remem, through its owner
Based in Ireland
Write to privacy@remempass.org about anything in this notice or to use your rights. General questions go to hello@remempass.org; security reports to security@remempass.org.
No data protection officer has been appointed. One is not required: the operator is not a public body, and the service does not involve large-scale monitoring of people or large-scale processing of special categories of data (GDPR Art. 37). The privacy address above reaches the operator directly.
The short version
- Remem is a password and secrets vault. Everything you keep in it is encrypted on your device before it is sent anywhere. We hold only ciphertext and cannot read, search or recover it.
- To join the waitlist we need your email address. Everything else on the sign-up form is optional.
- We set one cookie, only to keep you signed in to your website account. There is no analytics, no advertising and no tracking.
- Our data lives in the European Union, with Cloudflare as our only processor.
- You can download a copy of your data or delete your account yourself, at any time, from your account page.
Your website account and the waitlist
When you join the waitlist or sign in to remempass.org, we process:
| Data | Why |
|---|---|
| Your email address | To identify your account, send you sign-in and confirmation links, and tell you when your invite is ready. |
| What you would use Remem for (personal, family, work or developer), if you chose to say | To plan which features to build first. Optional. |
| Waitlist status, the time you joined, your place in the queue, your invite code and when it was sent, and when you joined the alpha | To run the waitlist fairly, in sign-up order, and let you see where you stand. |
| A record of what you agreed to: the version of the terms and of this notice and when you accepted them; that you confirmed you are at least 16 and when; whether you agreed to product emails, to which wording and when, and any later withdrawal | To show what you agreed to, which the GDPR requires us to be able to demonstrate (Art. 7(1)). |
| Sign-in sessions: a hashed session token, when it was created, last used and expires | To keep you signed in, and to let us end a session. |
| One-time links: a hashed token, what it is for, when it expires and whether it was used | So that each sign-in or confirmation link works once, and only for a short time. |
| A new email address you asked to change to, until you confirm it | So that a change only takes effect once the new address has proved it is yours. |
We do not store your IP address, your browser's user agent, or any device fingerprint in our database.
The Remem sync service
If you create a vault account in the Remem app and choose Remem Cloud, our sync server at sync.remempass.org processes:
| Data | Why |
|---|---|
| Your email address and account id | To identify your account when you sign in from another device. |
| Public salts, an SRP verifier and key-derivation settings | To let your devices prove they know your master password and Secret Key without ever sending either. The verifier cannot be turned back into your password. |
| Which invite admitted the account (a hash of the code, not the code) | To keep each invite single-use. |
| Your devices: the name the app gives each one (for example, your computer's name), its public key, and when it was added, last seen and removed | So you can see your devices and remove one you no longer trust. |
| Session records: a hashed token and its expiry | To keep each device signed in. |
| Your vaults and items, as end-to-end-encrypted ciphertext | To keep your devices in sync. We cannot decrypt them. |
| In the clear, alongside the ciphertext: item and vault ids, a timestamp-based clock, a deleted flag and an ordering number | The server needs these to put changes in order without reading them. They do reveal when an item changed, but nothing about what it contains. |
Your master password and Secret Key never leave your devices. Without them nobody, including us, can open your vault, which is also why we cannot recover it for you.
Keeping the service safe
- Bot protection. The sign-up and sign-in forms use Cloudflare Turnstile, which checks that a human is filling them in. To do that it processes signals from your browser, such as your IP address, TLS fingerprint, user agent and the site you are on. Cloudflare states it uses these signals only to detect and block bots, not to identify, profile or target anyone (Turnstile privacy addendum).
- Rate limiting. To slow down password guessing and form abuse, Cloudflare's rate limiter counts requests per IP address. The count lives only inside Cloudflare's rate limiter, for a 60-second window; we never see or store it.
- Request logs. Cloudflare keeps logs of requests to our service, including IP addresses, for about 7 days. We use them only to investigate faults and attacks.
Why we are allowed to process it
| Purpose | Lawful basis (GDPR Art. 6(1)) |
|---|---|
| Running your website account and the waitlist, and sending its emails | (b): steps you asked us to take before a contract, and the account you opened with us. |
| Providing the sync service | (b): the contract for the service. |
| Product news by email, if you opted in | (a): your consent, given with a separate box that is never ticked for you. You can withdraw it at any time on your account page or with the unsubscribe link in any such email. |
| Bot protection, rate limiting and request logs | (f): our legitimate interest in keeping the service and its users safe from abuse and attacks. We have weighed it against your interests: the data is minimal, kept briefly, and used for nothing else. You can object; see "Your rights". |
| Keeping a record that a data-rights request happened and when (without your email address) | (c) and (f): showing that we answer requests as the GDPR requires (Arts. 5(2), 12). |
No decision about you is made solely by automated means with legal or similarly significant effects, and we do not profile you. Invites go out in sign-up order, in batches the operator chooses.
Emails we send
We send only the emails the service needs: confirming your sign-up, sign-in links, confirming a change of email address, your invite, and confirmation that your account was deleted. They are sent through Cloudflare's email service and contain no tracking pixels and no tracked links.
If you tick the box for product news we record your consent, but we do not send a newsletter yet. If we start, it will go through a provider we will list on our sub-processors page before the first one is sent.
Who helps us
Cloudflare, Inc. and its group companies host the website and sync service and provide its database, storage, email and bot protection. They act as our processor under Cloudflare's Data Processing Addendum. Mail you send to our addresses is forwarded to the operator's own mailbox. The sub-processors page lists each one and what it does.
We do not sell your data, share it for advertising, or give it to anyone else, unless the law obliges us to.
Where your data is
Our database, file storage and the components that coordinate syncing are set up under Cloudflare's EU jurisdiction setting, which keeps that data, and where they run, inside the European Union.
Your requests reach Cloudflare's network at the location nearest to you, and that location can be outside the EU, for example when you travel. In transit, and for Cloudflare's own logging, billing and support, personal data can therefore be processed in other countries, including the United States. Those transfers are covered by the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum. Cloudflare also certifies under the EU-U.S. Data Privacy Framework (listing).
How long we keep it
| Data | Kept for |
|---|---|
| A sign-up you never confirmed | 7 days, then deleted |
| Sign-in links / confirmation links | 15 minutes / 24 hours; each can be used once |
| Website sign-in sessions | 30 days from last use, or until you sign out |
| Sync sessions | 30 days from issue, or until the device is removed |
| SRP sign-in handshakes | 60 seconds |
| Your website account | Until you delete it. An account unused for 24 months is deleted, after we email you first. |
| Your vault account | Until you delete it |
| Record that a data-rights request happened (no email address) | 36 months |
| Cloudflare request logs | About 7 days |
Deleting your account takes effect in our database immediately. Cloudflare keeps a point-in-time recovery history of the database, which on Cloudflare's paid plan covers up to 30 days. Deleted data can survive in that history until it ages out, and we restore from it only to recover from a fault. If we ever do restore, we delete again anything you had deleted.
Your rights
Under the GDPR (Arts. 15-22) you can:
- Get a copy of your data, and take it elsewhere. Use "Download a copy of your data" on your account page for your website data. For your vault, use Settings → Export server data in the Remem desktop app.
- Correct it. Change your email address on your account page.
- Delete it. Use "Delete your account" on your account page for your website account. For your vault account, use Settings → Account → Delete account in the desktop app. Deleting a vault asks for your master password, so someone who only gets into your email cannot destroy your vault. If you have lost your vault credentials, write to privacy@remempass.org and we will delete the vault account once we have checked that the address is yours.
- Restrict or object to processing, including the security processing based on legitimate interest, by writing to privacy@remempass.org.
- Withdraw consent to product emails at any time, without affecting anything sent before.
- Complain to a data protection authority, in particular in the EU country where you live or work. Ours is Ireland’s Data Protection Commission.
We answer within one month. If a request is complex we may extend that by two more months, and if so we tell you why within the first month. We confirm it is you by your control of the email address on the account; we will not ask for more than we need.
Children
Remem is not meant for children. You must be at least 16 to sign up, and we ask you to confirm it. If we learn that an account belongs to someone younger, we delete it.
How we protect it
- End-to-end encryption of vault contents, with keys that never leave your devices.
- SRP sign-in for the vault, so the server never receives your password.
- Session tokens and one-time links stored only as hashes.
- Data at rest in the EU, and connections over TLS only, with HTTP Strict Transport Security.
- A strict Content Security Policy on every page, and rate limits on every sign-in and sign-up route.
- Least-privilege access credentials for the infrastructure, and a documented breach-response procedure.
Found a vulnerability? See our disclosure policy.
Changes to this notice
We will update the date and version at the top when this notice changes. If a change affects how we use data you have already given us, we will email you before it takes effect.