The short version.
- Your vault is encrypted on your device before it goes anywhere.
- We hold the encrypted result. We cannot open it, and neither can anyone who takes our database.
- You do not need an account. Without one, Whisper never contacts us at all.
- There is no analytics, no advertising, and no tracking of any kind.
- Everything is hosted in the United Kingdom on renewable energy.
Who we are
Fiducia Whisper is made by Fiducia Together Ltd, a company registered in England & Wales, company number 17428906, registered office 9 Merlin Grove, Leyland, England, PR25 1DA. For the purposes of UK data protection law we are the data controller for the information described here.
For anything on this page — including a request to see, correct or delete your data — write to privacy@fiduciatogether.uk.
Whisper works without us
Whisper is usable in full without an account. If you never sign in, the app makes no network request to us, stores nothing on our servers, and we hold no record that you exist. Your vault lives on your device and nowhere else. Signing in is only ever needed to sync a vault between your own devices.
What stays on your device
Your logins, passwords, notes, folders and any other vault content are encrypted on your device with AES-GCM. The key that opens them is either wrapped under a passkey — using a secret only your authenticator can reproduce — or derived from your account password on your device using Argon2id. That derived key is never transmitted.
In a browser, the encrypted vault is kept in IndexedDB under a second AES-GCM key created as non-extractable: the browser will use the key but will not hand its bytes to any code, including ours. In a private window, or where storage is refused, nothing is written to disk and the vault is held in memory for that session only.
What our server holds, if you sign in
To sync between your devices we store:
- the encrypted vault as opaque ciphertext, with a version number and the time it was last written;
- wrapped copies of your vault key — one per passkey, plus one wrapped under the key derived from your account password. Each is unopenable by us;
- your registered passkeys: public keys and the device name and platform you gave them, so you can recognise and revoke them;
- your username and display name, and your account password stored only as a PBKDF2-HMAC-SHA256 hash with a random salt — never in readable form.
We do not ask for your email address, phone number, date of birth or address, and the app does not collect them.
What a complete breach of our server would yield: ciphertext, and a list of which devices exist. Not one usable password. This is a property of the design, not a promise about our conduct — which is the only kind of assurance worth giving for a password manager.
What we cannot do
We cannot read your vault, reset your master password, or recover your data if you lose every device and every recovery code. That is the necessary cost of the design above, and it is why the app asks you to keep a recovery code and an exported backup somewhere safe. If we could rescue you, so could anyone who successfully pretended to be you.
Connection data
As with any service reached over the internet, your device's IP address and the time of the request necessarily reach our server in order to return a response. This is used to operate and secure the service — for example to detect abuse — and is not used to build a profile of you, is not sold, and is not shared with advertisers.
Cookies, analytics and tracking
The Whisper app sets no cookies, contains no analytics, no advertising SDK, no crash-reporting service and no third-party tracker. Nothing you do in the app is measured or reported anywhere. There is no cookie banner here because there is nothing to consent to.
Where your data is, and what it runs on
Everything is hosted in the United Kingdom with Krystal Hosting Ltd, a UK company based in London, on infrastructure we chose partly for its environmental standing. Krystal publishes that its data centres run on 100% renewable energy without relying on offsets, that it has been a certified B Corporation since 2023, that its UK facility operates at a power usage effectiveness of 1.1, and that it is a member of 1% for the Planet and the UN Race to Zero. Its hosting is verified as green by the Green Web Foundation.
Those are Krystal's own published commitments rather than something we audit ourselves; we name them because a claim about green hosting should be checkable, and you can check it at krystal.io/green.
Your data is not transferred outside the UK by us. We do not use an overseas analytics, advertising or profiling provider, because we do not use one at all.
How long we keep it
Your encrypted vault and account are kept for as long as your account exists. Delete your account and the vault ciphertext, the wrapped keys and the passkey records go with it. Revoking a passkey removes its wrapped copy of your vault key immediately, which is what makes a lost device stop being able to open the vault.
Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to how it is used, and to receive a portable copy. Whisper's built-in export gives you a complete, decrypted copy of your vault on demand, which satisfies portability far better than a request queue would.
To exercise any right, write to privacy@fiduciatogether.uk. If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Whisper is not directed at children and we do not knowingly hold data about a child. Because the app requires no account and collects no profile information, we hold no age data about anyone.
Changes to this policy
If this policy changes in a way that affects what we collect or what we can see, we will update this page and change the date below. The underlying commitment — that the vault is encrypted before it reaches us — is a property of the software, and any change to it would be a change to the app itself, announced as such.