How fd0 handles your data.

• fd0 Desktop, the CLI, and the agent do not send usage analytics or advertising identifiers.
• The hosted sync service receives ciphertext, signed events, and the protocol metadata needed to sync them. It cannot read secret values, secret names, passphrases, private keys, or scope keys.
• The fd0 browser extension processes the active HTTPS origin and supported login fields locally. Passwords and one-time passwords are requested only after an explicit user action.
• The fd0.sh website uses no advertising, tracking analytics, or tracking cookies.

fd0 stores an encrypted vault, signed local event chains, non-secret configuration, and optional user-created recovery exports on the device. The local agent keeps the unlocked cryptographic identity and SSH key material in memory so the Desktop app and CLI can use one unlocked session.

Desktop settings and redacted diagnostic events are stored locally. Diagnostic data is not uploaded automatically; it leaves the device only when the user explicitly copies or shares it. The packaged Desktop app periodically checks for signed releases. Installing or updating can connect to fd0.sh and GitHub and exposes ordinary network request metadata to those services.

When a user starts SSH, SFTP, Kubernetes, Talos, or another remote operation, fd0 connects to the destination chosen by the user. That destination and its operator receive the data inherent to that connection.

The fd0 browser extension connects Chrome to the encrypted fd0 vault through a narrow native messaging host on the same device. It handles:

• the active HTTPS origin, used to find matching logins and prevent credentials from being returned to another origin;
• visible login form fields needed for autofill or an explicit save/update action;
• login titles, usernames, vault labels, opaque credential IDs, and revisions returned by the local host for that origin; and
• a password or one-time password only after an explicit user action. TOTP seeds remain in the encrypted fd0 vault.

The extension does not store passwords, TOTP seeds, or one-time passwords in Chrome Local Storage or Chrome Sync. A login candidate detected after form submission may be held in Chrome session storage for at most 60 seconds so the user can choose to save or update it. It is scoped to the originating tab, frame, and HTTPS origin and is then deleted.

https://*/* lets the extension detect supported login fields on encrypted pages. nativeMessaging connects it to the local fd0 host. activeTab and scripting support explicit toolbar actions and reconnect eligible pages after an extension update. storage and alarms hold and expire the short-lived candidate described above.

The extension does not remotely collect this browser data. Its use and transfer of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The official primary service at api.fd0.sh stores encrypted, signed protocol events. api2.fd0.sh is its read-only disaster-recovery replica, not a second writable sync target. It receives the same encrypted event history for recovery purposes.

Necessary metadata remains visible to both systems: public identity keys, a random short user ID, chain and scope identifiers, membership changes, signatures, event order and time, ciphertext sizes, and sync or replication request timing.

TLS is terminated by the service infrastructure. Source IP addresses are used for in-memory abuse and rate-limit controls and may appear in operational proxy or security logs. Idle in-process rate-limit entries are normally removed after ten minutes. Accepted protocol events are append-only and retained indefinitely so clients can verify history and detect rollback or equivocation. Encrypted events are also included in operational and disaster-recovery backups.

A self-hosted fd0 server follows the same ciphertext-only protocol, but its operator chooses the infrastructure, logging, and retention practices and is responsible for its own privacy information.

The website does not use accounts, advertising, behavioral analytics, third-party tracking pixels, or tracking cookies. It records aggregate request counts and operational logs such as the requested path, response status, and timing. The hosting layer necessarily receives normal connection data such as source IP addresses.

Following a link to GitHub or downloading a release hosted by GitHub transfers the request to GitHub, where GitHub's privacy terms apply.

fd0 does not sell personal data, use it for advertising or credit decisions, or make credential contents available to the service operator. Data is used only to provide, secure, maintain, and support the fd0 features described here.

Official fd0.sh infrastructure is operated in Germany by Kolb Antik GmbH, with a disaster-recovery service and ciphertext off-site backups hosted at Hetzner in Germany. Infrastructure providers process ordinary network and encrypted service data only as needed to operate that infrastructure.

Local vault data remains until the user changes or deletes it or removes the local fd0 data. Browser session candidates expire as described above. Hosted sync history follows the append-only retention described above.

Users can lock fd0, edit or logically delete records, change or disable sync, choose a self-hosted server, remove the browser extension, and unregister its native host with fd0 browser disable. Removing an app or extension does not by itself delete the fd0 vault.

For personal data handled by the official service, applicable rights may include access, correction, deletion, restriction, portability, objection, and a complaint to a data-protection authority. fd0 cannot identify or decrypt local-only data, and the hosted service cannot decrypt synced records. Append-only integrity records cannot be silently rewritten; record deletion is represented by a new signed event from the user's device.

The official fd0.sh services and the fd0 browser extension are operated by Kolb Antik GmbH, Germany. Full legal contact details are available in the Impressum. Privacy questions or requests can be sent to mail@valentin-kolb.com.

Material changes to how fd0 handles data will be reflected here. A change affecting the browser extension will also be reflected in its Chrome Web Store disclosure before release.

Effective date: 29 July 2026.