Privacy Policy

1. What this policy covers

This policy covers Lyn Password Generator, both the app and the web version, and the website lynsoftware.com. It explains what information is processed, why, and where it ends up. Lyn Calorie has its own policy.

2. The app

The app for phones and computers works entirely on your device:

• The password is calculated on the device
• Your master password and seed only exist in the device's memory while you use them
• Generated passwords are not stored and are not sent anywhere
• The app needs no internet connection and contacts no servers

The app only remembers your settings on the device: password length, special characters, whether the password is shown, theme, color theme and language. If the device is backed up, for example to iCloud, the settings can be included. Your passwords are never included.

3. The web version of the password generator

The web version calculates the password on our server, not in your browser. When you press Generate:

• Your master password, seed, length and special character choice are sent encrypted (HTTPS) to the server, through the protection against attacks in section 7
• The server calculates the password and sends it back to your browser
• None of this is stored

If you want your master password never to leave your device, use the app.

4. Cookies

The website only uses cookies it needs to work. None are used for analytics, tracking or advertising.

• The theme (light or dark, and the color) and language you have chosen
• The password generator's settings: length, special characters and whether the password is shown. Never your master password, seed or password
• A security cookie that stops other websites from submitting forms in your name
• A sign-in cookie, for our administrators only

5. Support

When you send us a request, we store your email address, the title, category, description and any images you attach. We use them only to answer you and fix problems. You can ask us to delete your request at any time. If the police order us to preserve data, we take an encrypted copy of the request and the related logs and keep it only for as long as the order applies. This is based on a legal obligation, and we hand over data only when the law requires it.

6. Security and abuse

To protect the service, the server processes your IP address and browser name for each request, for example to limit the number of attempts and stop attacks. When there is suspicious activity, we store the IP address, the browser, the country (looked up from the IP address on our own server), what was attempted and when, and the account when it is known, so the address can be blocked. The information about the activity is deleted after 90 days. A block (the IP address and the reason) is kept until it expires and deleted 90 days after that. Requests are logged (IP address, browser, the address without parameters and the response) on our servers at UpCloud and deleted after 30 days.

7. Where information is processed

Our servers and database are hosted by UpCloud in Norway, and our files by UpCloud in Finland. Everything you send to the website first passes through Bunny.net (Slovenia), which stops attacks and overload before they reach our servers. Bunny uses only servers in the EU, and sees your IP address and what you send, including what you type into the password generator, but does not store the content. Bunny logs the requests (your IP address shortened, browser, country, the address and the response), and requests that look like attacks with the full IP address. The logs are deleted after three days. Support email is sent through an email provider in the EU (France). We use no analytics tools or advertising networks, and we never sell information.

8. Children

We do not knowingly collect information about children under 13. The password generator can be used by anyone.

9. Changes

When this policy changes, the new version is published here with a new date at the top.

10. Contact

Questions about privacy, or a request to delete a support request: