Privacy
OpenSesame is built so the operator of the public site cannot read a vault. Item encryption and decryption happen in the browser with a key derived from the person's master password. The static site does not receive that key.
What the public site stores
The Pages build serves static files. It does not run a hosted vault database, does not accept a master password on a server, and does not keep a copy of vault items. Browser storage on the device holds the encrypted vault and its local configuration.
What leaves the device
A network request leaves the device only when a feature needs one: for example, a native connector, an identity provider, or a backup target that the person configured. Those requests are visible to the provider they name. OpenSesame does not add analytics or advertising identifiers to the Pages build.
Recovery
There is no server-side password recovery. Losing every enrolled unlock method loses the vault. Keep an encrypted backup and the recovery methods you enrolled.
More
The repository's privacy architecture and security policy describe the design in detail.