1. Introduction and zero-knowledge commitment
At Monark Password Manager (developed by Xilistudios), privacy and data sovereignty are founding principles. Your passwords, credentials, notes and confidential documents belong to you and to nobody else.
Monark operates under a strict zero-knowledge architecture and a local-first model. We do not collect your data, we do not store it on servers we control, and we have no technical means of reading or decrypting your passwords or your vault's master key. All cryptographic work happens on your device.
2. What we process, and what we never process
2.1 Vault contents — no access
Your passwords, usernames, URLs, secure notes and two-factor authentication data are stored encrypted on your own hardware. Xilistudios never receives them in plaintext and never stores them on external servers.
2.2 Telemetry and tracking
Monark contains no advertising trackers, no advertising identifiers and no invasive analytics that record your browsing behaviour or personal identity.
3. Use of the Google API and Google Drive
Monark gives you the option of keeping a synchronised backup in your own personal Google Drive account. To make this possible the application authenticates over OAuth and requests only the single, minimal scope required:
Scope requested: https://www.googleapis.com/auth/drive.file
This permission only allows Monark to create, view, modify and delete the files and folders created directly by the Monark application itself, in order to hold your encrypted backup.
Monark cannot access, read or modify any other file, document, photo or folder already present in your Google Drive.
Compliance with Google's Limited Use requirements.
Monark's use and transfer of information received from Google APIs adheres to the
Google API Services User Data Policy, including the Limited Use requirements.
3.1 Strict restrictions on Google data
- No sale or commercialisation: we never sell, licence, trade or transfer user data obtained through Google Drive to third parties, data brokers or advertising agencies.
- No personalised advertising: no data obtained through Google APIs is used to serve ads, build commercial profiles or retarget you.
- No AI training: data obtained through Google APIs is never used to train large language models, machine-learning systems or artificial-intelligence algorithms.
- Restricted human access: no employee or developer of Xilistudios has human access to the vault files stored in your Google Drive, except where legally compelled or where you explicitly consent for technical debugging — and even then the data is strongly encrypted end to end.
4. Data security and encryption
Before any backup file is transmitted to your Google Drive, Monark derives and encrypts it in the Rust core using the following primitives:
- Key derivation (KDF):
Argon2id with parameters resistant to brute force and GPU acceleration (64 MB memory, 3 iterations, 4-thread parallelism).
- Authenticated symmetric encryption:
XChaCha20-Poly1305 (IETF variant) with 256-bit keys and random 192-bit nonces.
- Memory protection: secure erasure of in-memory credentials (
ZeroizeOnDrop) to prevent forensic extraction attacks.
5. Control, rights and data deletion
As a user you keep absolute control at all times:
- Access and portability: export your vault at any time from the application settings.
- Deleting backups: remove backup files from within Monark, or by deleting the Monark folder in your own Google Drive storage.
- Revoking permissions: revoke Monark's access to your Google account at any time on Google's official permissions page: myaccount.google.com/permissions.
6. Links to third-party sites
Monark may offer optional integration with external storage services such as Google Drive, Nextcloud or WebDAV servers. Your interaction with those services is governed by the respective provider's privacy policy and terms of service.
7. Changes to this policy
We reserve the right to update this Privacy Policy to reflect improvements to the application, new features or regulatory requirements. For substantial changes we will publish the updated version on this site with a new effective date.
8. Contact
If you have questions about this Privacy Policy or about Monark's security practices, you can reach the Xilistudios development team through our official GitHub repository.
Xilistudios
Repository and support: https://github.com/xilistudios/monark
