🔒 Local processing · No sign-up
passly.
Legal

Privacy Policy

We care about your privacy. This document explains what data we process and for what purpose.

Last updated: August 11, 2026

The rules for using the service (including liability disclaimers) are described in a separate Terms of Service.

Key Information

No password storage

The generator runs locally in your browser. Passwords are not sent or stored on the server.

Analytics

We use Google Analytics and Search Console for statistics and visibility improvement.

Advertising

Google AdSense may display ads on the site (including personalized ones).

Data Controller and Contact

The data controller is the owner of Passly.pl. Contact: contact@passly.pl.

Scope of Data and Processing Purposes

  • Password generator: works locally – we do not collect passwords or form data.
  • Password check (Have I Been Pwned): your password is hashed locally (SHA-1) – only the first 5 characters of the hash are sent to the external API, using k-anonymity. The full password never leaves your browser.
  • Email check (XposedOrNot): the email address you enter is sent to the independent, external XposedOrNot service to check it against a database of known breaches. We do not store this address on our own servers.
  • Statistics: anonymous traffic data (Google Analytics).
  • Google visibility: analysis and improvement via Search Console.
  • Monetization: display of Google AdSense ads (including personalized) and affiliate links (e.g. to RoboForm).

Features That Run Entirely Locally

Generated passwords, the recent-password history shown in the generator card, and clipboard contents are processed only in your browser’s memory. History disappears when the page is refreshed, and the clipboard — if you enable that option — is cleared automatically 30 seconds after copying a password. None of this data is stored on our server or sent anywhere beyond your device.

Cookies and Similar Technologies

The site may use cookies and similar technologies for necessary, statistical, and advertising purposes.

  • Necessary (e.g. "lang"): ensure basic site functionality, such as remembering your chosen interface language.
  • Analytics (Google Analytics): help understand how users interact with the site. Data is anonymous.
  • Advertising (Google AdSense): may be used to personalize ads.

You can change cookie settings in your browser. Limiting cookies may affect some features of the site.

Google Tools: Analytics, Search Console, AdSense

Google Analytics – analyzes traffic and creates reports, data is anonymous.

Google Search Console – monitors visibility and indexing issues.

Google AdSense – displays ads and personalizes content.

See Google’s privacy policy for details. You can manage ad personalization in Google Ads settings.

External Service Providers

Individual features of the site rely on independent, external providers. Below is a full list of the external services Passly.pl uses, along with their role.

  • Have I Been Pwned (haveibeenpwned.com) – checks the password hash against a breach database, using k-anonymity.
  • XposedOrNot (xposedornot.com) – checks an email address against an independent breach database.
  • Google Fonts (fonts.googleapis.com, fonts.gstatic.com) – serves the Inter and Sora fonts; this involves sending your IP address to Google when the page loads.
  • Google Analytics / Tag Manager – visit statistics and management of analytics scripts.
  • Google AdSense – displays ads on the site.
  • flagcdn.com – serves flag icons in the language switcher.
  • RoboForm (roboform.com) – affiliate partner; clicking the link takes you to RoboForm’s site, where their own privacy policy applies.

Data Recipients and Transfers Outside the EEA

Statistical and advertising data may be processed by Google; data entered into the breach checker is processed by Have I Been Pwned or XposedOrNot, depending on the feature used. Transfers outside the EEA comply with legal mechanisms used by these providers (e.g. standard contractual clauses).

Data Retention Period

Data is stored for as long as necessary to achieve the purposes stated in this policy or until consent is withdrawn.

Your Rights (GDPR)

  • access and obtain a copy of your data,
  • rectification of data,
  • erasure of data ("right to be forgotten"),
  • restriction of processing,
  • data portability,
  • objection to processing,
  • withdrawal of consent (if applicable).

You have the right to lodge a complaint with the Data Protection Authority if you believe your data is processed unlawfully.

Security

We apply technical and organizational measures. The generator works locally – passwords are not sent to the server.

Additional Information

  • External links: may lead to sites with their own privacy policies.
  • Children: the service does not knowingly collect data from children under 13.
  • Changes: this policy may be updated – the new version will be published on this page.

Have questions about privacy? Contact us: contact@passly.pl

Back to password generator