This Privacy Policy describes how information is handled when you use Vault App's website, applications, and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this policy.
Vault App has no technical means to access your encrypted passwords, secure notes, credit card information, or other items stored in your vault. The Service is built on a zero-knowledge architecture, which means only you know what is stored in your vault.
In cryptography, zero-knowledge refers to being able to prove you know something without revealing what that is. This zero-knowledge password manager keeps the proof that you have the key, but not the key itself. No one else can see your passwords, credit card details, or secure notes.
Your master password is never held by the Service. Your encrypted data remains secure even if network infrastructure were compromised.
In addition to vault data—which remains unreadable to anyone but you—the following information may be processed when you use the Service:
When you create an account, information necessary to operate the Service is collected, such as your username and account credentials. Your account password is hashed before storage. A cryptographic salt used for encryption key derivation is also associated with your account.
When you visit the website or use the applications, certain technical information may be collected automatically. This may include your IP address, browser type, device type, operating system, pages visited, and similar diagnostic information.
Analytics tools may be used to understand how the Service is used and to improve performance, reliability, and user experience. Analytics data is generally aggregated and does not include the contents of your vault.
Limited metadata needed to operate the Service may be processed, such as account identifiers, subscription type, timestamps related to account activity, and information about whether the application is functioning correctly. This information supports maintenance, security, and reliability of the Service.
Because of the zero-knowledge architecture, the following remain inaccessible to anyone but you:
Vault App may offer features that help you review account and vault activity, such as log-ins, password changes, and related events. Activity information is associated with your account and is intended to help you stay informed about use of your vault.
Where password history is available, it allows you to view recent password changes for an item. This information is accessible only to you and remains protected by the same encryption and access controls that apply to your vault.
Information processed by the Service is used to:
Personal information is not sold.
Password sharing is intentionally not supported by Vault App. This design helps ensure that each user maintains exclusive control over their credentials and sensitive information, reducing risks associated with shared access.
Trusted third-party providers may be used to help operate the Service, such as hosting, infrastructure, analytics, and email delivery providers. These providers may process limited personal data solely to operate the Service.
Vault data stored through the Service remains encrypted. Third-party infrastructure providers cannot decrypt or access the contents of your vault without your master password and encryption keys.
Personal data associated with active accounts is retained for as long as your account remains active, unless you request deletion or deletion is required by law.
Retaining account-related data while your account is active helps ensure that encrypted vault data associated with your account is not lost due to premature deletion of necessary account records.
Administrative, technical, and organizational measures are designed to protect personal data and the integrity of the Service. Vault data is encrypted on your device using AES-256-GCM before it is stored or synchronized.
No method of transmission or storage is completely secure. Absolute security cannot be guaranteed.
You may stop using the Service or delete your account at any time, subject to any technical or legal limitations on deletion.
Because your master password and vault contents remain under your exclusive control, account recovery without your master password is not possible. You are responsible for maintaining access to your master password and any recovery methods you configure.
The Service is intended for individuals who are at least 18 years old. Personal information is not knowingly collected from children under 18.
This Privacy Policy may be updated from time to time. Material changes will be posted on this page. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy, contact support@vault0.app.