SolidPass is built from the ground up for absolute, uncompromising privacy. We operate on a zero-cloud, zero-trust architecture. We do not collect, share, monetize, or even see your data. Because the application runs 100% offline, there are no remote servers, databases, or tracking SDKs. You are the sole custodian of your digital vault.
1. Scope & Acceptance
This Privacy Policy describes how Air Microservices LLC ("we," "us," or "our") handles data in the SolidPass mobile application ("SolidPass" or the "App"). By downloading, installing, or using SolidPass, you agree to the practices outlined in this policy.
2. Information Collection and Transmission
Because SolidPass is designed as an offline-first utility, our data collection practices are simple: we collect absolutely nothing.
- Personal Data & Accounts: SolidPass does not require or support user accounts, registration, email sign-ups, or profile creation.
- Vault Contents: Your passwords, credit cards, contacts, identity profiles, credentials, notes, scanned documents, file attachments, and other sensitive information stay on your device. We have no technical access to this data, and it is never transmitted over the internet.
- Network Logs: The App operates entirely without internet access permissions on your device. It cannot communicate with remote systems or external servers.
- No Tracking or Analytics: We do not integrate any third-party tracking, analytics SDKs (such as Google Analytics or Firebase), or advertisements. Your interaction with the App remains entirely private.
- On-Device Scanning & Camera Isolation:When using "Scan & Autofill" features (for scanning documents, payment cards, or identity documents like passports and driver's licenses), all image analysis, perspective correction, and text extraction (such as parsing credit card numbers or passport MRZ fields) are executed 100% locally and offline on your device using native APIs (like Apple VisionKit and Google ML Kit). Photos and scans captured during this flow reside solely within the App's secure sandbox cache, are never saved to your device's public photo gallery or camera roll (savesToPhotoLibrary: false), and are never sent to external servers. Extracted data is only pre-populated on your screen for review and is not saved to your vault until you explicitly tap Save.
3. Local Encryption & Security
Your data is secured locally using state-of-the-art cryptographic standards:
- Master Password Security: Your Master Password is never stored on disk. SolidPass derives a robust Key Encryption Key (KEK) using Argon2id (RFC 9106), a memory-hard key-derivation function designed to resist brute-force attacks from GPUs and specialized hardware, together with a secure, cryptographically random salt.
- Database Encryption: A secure 256-bit Database Key (DK) is generated locally to encrypt your SQLite database. Individual sensitive items and file attachments (stored in a normalized, dedicated table for optimal list performance) are further encrypted using AES-256-GCM with unique 12-byte initialization vectors (IVs) and authenticated tags. Item metadata — titles, types, tags, and attachment names — is encrypted as well, so a copied database or backup file reveals nothing about your entries.
- Memory Security (Zeroization):Sensitive buffers, passwords, and derived keys are explicitly wiped (zeroized) from your device's active memory immediately after use to prevent memory-snooping attacks.
- Global Screen Capture Prevention: SolidPass enforces native screen capture and screenshot blocking app-wide. Screenshots and video recordings are completely blacked out to prevent exposure of sensitive vault information.
4. Biometric Data & Device Keystore
If you enable Biometric Unlock (Fingerprint or Face authentication), the App utilizes the native operating system APIs (such as the Android Keystore or iOS Secure Enclave).
The biometric authentication process is handled entirely by your device's operating system hardware. SolidPass never accesses, views, collects, or stores your biometric data. The App only receives a cryptographic token confirmation from the operating system to safely release your locally stored database key.
5. Encrypted Backups
You have the option to export your vault into a fully encrypted backup file with the extension .solidpass.
Backups are signed with a SHA-256 checksum to ensure data integrity. They are stored locally on your device or in a directory of your choosing. Since these files are encrypted, they can only be restored using the exact Master Password that was active when the backup was created. Air Microservices LLC does not store, host, or have access to your backup files.
6. Third-Party App Stores
SolidPass is distributed through third-party platform stores (such as the Apple App Store and Google Play Store). These platforms may collect transaction data, device identifiers, or basic usage statistics under their own respective privacy policies. We encourage you to review the privacy policy of the app store from which you download the App.
7. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Since the App has no network functionality, we cannot notify you of updates within the App. We recommend checking this page periodically for any changes.
8. Contact Us
If you have any questions or inquiries regarding this Privacy Policy or SolidPass, please contact us at:
Air Microservices LLC
Email: solidpass@airmicroservices.com