Privacy Policy

1. Overview

Your data is always encrypted at rest. Vaults (environment variables) are server-managed: their keys are protected by a server application key, so we technically can decrypt vault content (we don't access it in normal operation) — this enables passwordless login and CLI/CI use. Your password manager is zero-knowledge: it is protected by a master password that never leaves your device, so we can never decrypt your passwords.

2. Data Collection

We collect minimal data necessary to provide our service:

• Account Information: Your email address and basic profile details for authentication.
• Encrypted Data: Your secrets and vault configuration, stored in an encrypted format.
• Usage Logs: Basic technical logs (IP address, browser type) to improve security and performance.

3. Security Architecture

Our security model relies on the follow technologies:

• Email magic code: Passwordless login — no login passwords stored.
• XChaCha20-Poly1305: Authenticated encryption of all stored content.
• Curve25519: Identity + password keys used to share keys between members.
• Argon2id: Derives your password-vault master key locally (never sent to us).
• AES-256-GCM: Server-side wrapping of identity private keys at rest.

4. Your Rights

You have the right to access, export, or delete your data at any time. Deleting your account permanently removes your encrypted data and identity keys.

5. Data Deletion

If you wish to delete your account and all associated data, you can do so through your account settings or by visiting our Data Deletion Request page.