Privacy

Last updated 3 November 2026

Satchel is a password manager, so this page is short on purpose: your vault never reaches us. Satchel is made by Bilal Meddah. Questions go to satchel@echospace.dev.

The Mac app

• Your vault stays on your Mac. Every item is encrypted on your Mac before it is written anywhere. We have no account system and no copy of your vault, your master password or your keys.
• Sync goes where you choose. If you turn sync on, Satchel sends only encrypted files to the host you set up (your GitHub repository, S3 bucket or WebDAV server). That host sees sealed files, not titles, usernames or passwords. We never see that traffic.
• Update checks. If updates are on, Satchel asks satchel.echospace.dev for the latest version shortly after launch and then every six hours. The request carries the app's version and nothing else. Like any web request, it reveals your IP address to our host, Cloudflare.
• No analytics, no tracking, no crash reports. The app contains none of these.
• The trial and your licence key are checked on your Mac, offline.

The browser extension

• It talks only to the Satchel app on the same Mac, through the browser's native messaging. It makes no network requests of its own.
• What it reads: the address of the page you are on and its login fields, so it can offer the logins saved for that site. It reads what you typed into a login form only when you click Save this login. It fills or copies a login only when you choose one.
• What it keeps: nothing. It stores no logins, no history and no settings of its own.
• It collects no data and sends none to us or to anyone else. Nothing is sold or shared, and nothing is used for advertising or credit decisions.

This website

• No cookies, no analytics. The site loads nothing from other companies, except the checkout when you click Buy.
• Hosting. Cloudflare serves the site and the downloads. It processes your IP address to deliver pages and stop attacks.

Buying Satchel

• Paddle handles the payment. Paddle.com is our reseller and the merchant of record. It collects your name, email address, country and payment details, under Paddle's privacy policy. We never see your card.
• What we keep: your licence key, with Paddle's order number and customer number, so the thank-you page can show it again. We use these only to give you your key and to answer you if you write to us.
• How long: as long as your licence exists. Write to us to have it deleted.

Your rights

You can ask what we hold about you, have it corrected, or have it deleted, by writing to satchel@echospace.dev. If you are in the EU or the UK, you can also complain to your data protection authority.

Changes

If this page changes, the date at the top changes too. The app's source code is public, so you can check each claim here.