The short version: Bramble is a local-first password manager, available as a browser extension and as mobile apps. It does not collect, sell, or share any of your data. There is no account and no Bramble server that holds your vault. Everything stays on your device, encrypted. Bramble makes network connections only for a few optional features that are off by default and that you turn on yourself: a password breach check, peer-to-peer sync between your own devices, and encrypted backups to a storage provider you choose. None of them ever exposes your passwords or your vault in a form that Bramble, a provider, or anyone else could read. Details below.
What data Bramble handles
Bramble stores the data you choose to save in it, such as login usernames and passwords, passkeys, payment cards, secure notes, SSH keys, and two-factor (TOTP) seeds, together with your own app preferences. This data is created and used only to provide the password-manager features you asked for (saving, searching, and autofilling your credentials).
Where it is stored
Your vault is stored only on your devices. In the browser extension that means your browser's local extension storage and/or a vault file you pick on your own computer. In the mobile apps it means the app's private on-device storage, with a small number of secrets (the key that protects your vault) held in the OS keystore. Bramble has no vault server, so your data is not stored off your devices unless you turn on cloud backups (below), which keep an encrypted copy with a storage provider you choose.
How it is protected
Your vault is encrypted. The key that protects it is derived from your master password using Argon2id, and individual entries are encrypted with AES-256-GCM. Encryption and decryption happen locally on your device. Your master password and the keys derived from it are never stored in plaintext and never leave your device.
What Bramble does not do
- No data collection, tracking, analytics, telemetry, or advertising.
- No accounts, sign-up, or login to any service.
- No Bramble vault server or cloud. Bramble runs no server that stores your vault. If you turn on backups, only an encrypted copy goes to a storage provider you choose and control (see "Cloud backups" below); the ciphertext is all that ever leaves your device.
- No selling, renting, or sharing of your data with anyone.
- No use of your data for any purpose other than the features you use.
Network connections, in full
Bramble works entirely offline by default. There are three features that make network connections, all optional and all off until you turn them on: the password breach check, device sync, and cloud backups. They are described next. Bramble makes no other network requests.
Password breach check (optional)
Bramble can tell you whether one of your saved passwords has appeared in a known data breach. This feature is off by default; you turn it on in Settings.
When it is on, Bramble checks a password using the Have I Been Pwned "Pwned Passwords" service with a privacy-preserving method called k-anonymity: it computes a SHA-1 hash of the password and sends only the first five characters of that hash to its API (api.pwnedpasswords.com). The service returns a list of possible matches and Bramble compares them on your device. Your password, and even its full hash, never leave your device, and Have I Been Pwned cannot tell which password you checked. Bramble also asks the service to pad its response so the amount of data returned reveals nothing about your query.
Have I Been Pwned is operated by a third party under its own privacy policy: haveibeenpwned.com/Privacy.
Syncing across your own devices (optional)
Bramble can sync one vault across your own devices (for example between two browsers, or between a browser and a phone). This is optional and off until you set it up by linking a device, and it is strictly personal: only your own devices, only your own vault. There is no shared network, and there is no Bramble server that stores or relays your vault.
How it works, and what each part can see:
- The vault transfer is device-to-device. Your devices connect directly to each other over your local network and exchange the vault over that direct, encrypted connection. The vault stays end-to-end encrypted under a key that only your devices hold.
- A signaling relay only helps your devices find each other. To set up the direct connection, your devices exchange brief connection details through a relay (a WebSocket server). By default this is a relay we run, but you can point Bramble at your own relay or at any public relay that speaks the same protocol. The relay never receives your vault, your passwords, your master password, or any key that could decrypt them.
- The relay sees only opaque data and basic metadata. The signaling messages it passes along are themselves encrypted with a key it does not have, and the "room" your devices meet in is addressed by an unguessable value derived from that key, so the relay cannot tie it to you. The most it can observe is that two network addresses connected, and when. The direct channel between your devices is mutually authenticated, so a dishonest relay cannot read, alter, or impersonate either device; it can at most refuse to help, in which case you can link devices by scanning a QR code instead.
Cloud backups (optional)
Bramble can keep an encrypted backup of your vault with a storage provider you choose. This is optional and off until you set it up, and you can turn it off or remove your backups at any time.
What this does and does not expose:
- Only ciphertext leaves your device. A backup is the same client-side-encrypted blob as a local export: it can be opened only with your master password. Encryption happens on your device before anything is uploaded, so the provider stores opaque data and never sees your passwords, your vault, or any key that could decrypt them.
- You pick the destination, and Bramble has no server in the middle. Bramble uploads directly to the storage you configure: Dropbox (which you connect with a normal sign-in), or any S3-compatible or WebDAV storage, including services you self-host. Bramble runs no backup server of its own and keeps no copy.
- The provider is a third party under its own terms. Whatever storage you choose receives the encrypted file and the account or connection details needed to store it, and handles them under its own privacy policy. Because the file is encrypted, that is all it can see.
Autofill
In the browser extension, Bramble's content script runs on web pages and looks at the structure of forms on the page (for example, whether a field is a username, password, or one-time-code field) so it can offer to fill saved credentials. This happens entirely on your device. Bramble does not read, collect, or transmit the content of the pages you visit, and it only fills a credential when you explicitly choose one.
On mobile, autofill uses the operating system's own AutoFill framework. When you pick Bramble to fill a login, the system hands Bramble the app or website you are filling so it can find a matching entry. Bramble's autofill runs in a separate, locked component that reads your vault only after you authenticate (with biometrics, your device passcode, or your master password) and then decrypt it; nothing in your vault is readable before that.
Passkeys and security keys
Bramble can act as a passkey provider (and, in the browser extension, a security-key provider) for the sites and apps you sign in to. When a site asks you to create or use a passkey, your browser or device can offer Bramble: the passkey's private key is generated and kept in your encrypted vault, stored as an ordinary vault entry, and never leaves it. Bramble only signs the challenge the site sends, and only after you approve. In Chromium browsers this uses the browser's Web Authentication proxy; on mobile it uses the operating system's passkey framework. No passkey material is ever sent to Bramble.
On mobile: unlocking, key storage, and keyboard suggestions
- Biometric unlock. If you turn it on, Bramble caches your vault key behind a hardware-backed biometric gate provided by the operating system (the iOS Keychain and Secure Enclave, or the Android Keystore). The key is released only after a successful biometric or device-passcode check, and the system invalidates it if your enrolled biometrics change. This is a convenience built on the operating system's own protection; it stays on your device.
- Shared storage with the autofill component. So that AutoFill can work, its autofill component reads your logins from encrypted, app-private storage on the device. That storage is protected with your vault key and is not readable without unlocking, and nothing in it ever leaves the device.
- Keyboard suggestions (iOS, off by default). On iOS you can optionally let Bramble show matching logins as suggestions above the keyboard. Turning this on provides your saved usernames and the websites they belong to (but never your passwords) to iOS, so the system can show those suggestions even before you unlock Bramble. It is off by default precisely because it makes those usernames visible to the operating system before authentication; you can turn it off at any time.
- Camera. Bramble can scan QR codes (to link a device for sync, or to add a TOTP secret) using your camera. The scanning happens on your device and the camera images are not stored or transmitted.
Browser extension permissions, in plain language
- Access to websites: to detect login fields and offer autofill.
- Storage: to keep your encrypted vault and preferences on your device.
- Clipboard: to copy a password and clear it after a timeout.
- Alarms and idle: to lock the vault automatically after inactivity or when your screen locks.
- Offscreen: to run the encryption module.
- Web authentication: to let you use Bramble as a passkey or security-key provider for websites (Chromium browsers).
- Identity: to run the provider's sign-in screen when you connect a cloud-backup account such as Dropbox.
Clipboard
When you copy a password, Bramble writes it to your clipboard and, after a short timeout, clears the clipboard to reduce the chance of a secret lingering there. This is done locally and the copied value is never sent anywhere.
Importing other password files
If you import a vault from another manager (for example a KeePass .kdbx file), Bramble reads that file locally to add its entries to your vault. The file and its contents are processed only on your device and are not transmitted anywhere.
Recovery and lost access
Bramble has no copy of your master password or the keys derived from it, so it cannot recover your vault or reset your password for you. If you set up a recovery code or a security key, you can use those to regain access. If you lose your master password and every recovery method you set up, your vault cannot be decrypted by you, by us, or by anyone. That is the trade-off for there being no backdoor.
Data retention and deletion
Because your data lives only on your devices, you are in control of it. Removing the extension or the app, deleting your vault file, and clearing the app's or extension's storage removes your data. Bramble retains nothing on your behalf because it holds nothing about you anywhere else. If you turned on cloud backups, delete the encrypted backup files from your storage provider too, since those live in your account there, not with Bramble.
Children
Bramble is a general-purpose tool, not directed at children, and collects no information from anyone.
Changes to this policy
If this policy changes, the updated version will be posted here with a new effective date.
Contact
Questions about this policy or your privacy? Email [email protected].