Privacy Policy

WizPro Software (“WizPro”, “we”) makes WizAuth: the WizAuth apps for Android and iPhone, the WizAuth browser extension for Chrome, Edge, Firefox and other browsers, and the service at wizauth.net that keeps your account in sync. This policy explains what we store, what we can never see, and the choices you have.

What is end-to-end encrypted

Everything you keep in your vault is encrypted on your device (AES-256-GCM) before it’s sent to us:

• logins, passwords, cards, notes, identities and other items, and the names of your folders;
• your 2FA (authenticator) accounts and their secret keys;
• your account’s private key, used to receive items shared with you or sent to you by connected apps.

Your master password is turned into keys on your device (PBKDF2-SHA256, 600,000 rounds). We receive only a proof that you know it, which we store hashed. This is also why we can’t reset your master password: your recovery key is the only other way back in, so keep it somewhere safe.

What we store about your account

• Your email address, to identify your account.
• Your encrypted vault (see above), the encrypted keys that protect it, and your account’s public key.
• Your signed-in devices: a name such as “Android phone” or “WizAuth extension on Chrome”, its type, when it was last used, and on phones a push-notification token so we can send you sign-in requests.
• Security records: when you sign in, sign out, approve or deny a sign-in request, or change security settings, we record when it happened and the IP address and browser or app it came from. We use this to protect your account, to show you your devices and history, and to stop abuse.
• Connected apps: which business apps you’ve linked (for example IT-ServiceWiz), and the sign-in requests they sent to your phone and your answers.

Credentials sent by connected business apps

If you link a business app such as IT-ServiceWiz, it can send logins and API keys to your WizAuth account. With the current version of WizAuth, they’re sealed to your account’s public key before they’re stored: IT-ServiceWiz seals them before sending, and if an app sends one in plain form, our server seals it on arrival and never stores the plain copy. Only your own devices can open them, and they become normal, end-to-end encrypted vault items.

If you still use the earlier version of the WizAuth app, it can only read them in plain form, so until you update they’re stored as the connected app sends them, protected by our server security but not end-to-end encrypted. When you update, they’re all sealed as soon as the new app has confirmed it has every one of them.

On your devices

Phone apps

• An encrypted copy of your vault is kept on the phone so it works offline.
• Fingerprint, face and PIN unlock use your phone’s secure hardware. We never receive your fingerprint, face or PIN, and the operating system handles biometrics.
• The camera is used only to scan 2FA QR codes, and nothing it sees is sent to us.
• On Android, WizAuth can be your autofill service: it looks at the sign-in form in front of you to offer the right login, on your phone only. It never sends us which apps or websites you use.

Browser extension

• To find and fill sign-in forms, the extension can read the pages you visit. It does this inside your browser only: it never sends us the addresses or contents of the pages you visit, and it never builds a browsing history.
• It fills a login only into a page or frame of the site that login is saved for. When you sign in somewhere, it remembers that username and password in your browser’s memory for up to 10 minutes, so it can offer to save them. It sends them to us only if you choose to save them, and then only encrypted.
• If you unlock the extension with your phone, the extension creates its own key pair in your browser and your phone sends the vault key to it encrypted to that key, only after you tap the matching number. We pass the encrypted key along without being able to open it, and delete it as soon as the extension has picked it up, or after 2 minutes. We keep a record of the request (when, the browser’s name, and whether it was approved), like other security records.
• It talks only to wizauth.net. The extension’s use of your information is limited to providing its password-manager features; we don’t sell it, use it for advertising or credit decisions, or let people read it. This is in line with the Chrome Web Store and Firefox Add-ons user-data policies.

Who else is involved

We use a small number of service providers, only to run WizAuth:

• Vercel, which hosts wizauth.net;
• Neon, which runs our database (your vault reaches it only encrypted);
• Google Firebase Cloud Messaging, which delivers sign-in request notifications to your phone;
• SendGrid, which sends account emails.

Connected business apps you choose to link (such as IT-ServiceWiz) receive what’s needed to ask you to approve sign-ins and your answers. We don’t share your information with anyone else, except where the law requires it. Even then, we can only provide what we have, and we never have your master password or the contents of your vault.

How long we keep it

• Your account and vault: until you delete your account.
• If you upgraded from the earlier version of WizAuth: the old copy of your data stays untouched for at least 30 days as a safety copy, then it’s deleted. The one exception is credentials from connected apps: those are sealed to your account key as soon as your upgrade is confirmed (see above), and the business app keeps its own copy.
• After you delete your account, we may keep a limited record of security events where needed to prevent abuse or meet legal obligations. Backups age out on their normal schedule.

Your choices

• Export your vault at any time (Settings → Export).
• Sign out devices you don’t recognise (Settings → Signed-in devices).
• Disconnect connected apps (Settings → Connected apps).
• Delete your account and everything in it (Settings → Delete account).
• Ask us what we hold about you, or to correct or delete it, at support@wizprosoftware.com.

Children

WizAuth isn’t meant for children under 13, and we don’t knowingly collect information from them.

Changes

If we change this policy, we’ll update the date above. If a change matters, we’ll also tell you in the app or by email before it takes effect. See also our Terms of Service.

Contact

WizPro Software — support@wizprosoftware.com