Privacy policy.

Vault is operated by James Argarin, based in Manila, Philippines. Questions about this policy or your data can be sent through the contact form on the landing page.

Everything you store in your vault — logins, secure notes, payment cards, one-time-code secrets — is encrypted on your device before it is synced, using keys derived from your master password inside a WebAssembly module running in your browser. Neither the master password nor any key derived from it is ever transmitted.

This is not a policy decision we could quietly change; it is how the system is built. The server stores ciphertext it has no means of decrypting, so we cannot read your items, search them, sell them, or hand them over in readable form — to anyone.

We store, and can read, the following:

• Your email address, and whether it has been confirmed.
• A login credential derived from your master password on your device (Argon2id over the password, salted with your email). It authenticates you but cannot decrypt anything.
• Account and session metadata: timestamps, session tokens, and the standard records Supabase Auth keeps.
• Item metadata that syncing needs: item ids, types, version numbers and timestamps — never item contents.

Each item is stored as an XChaCha20-Poly1305 ciphertext with its nonce and version columns. The database schema has no plaintext content columns to fill. Deletions are soft (a timestamp) so your other devices can learn about them; a deleted item's ciphertext is retained until cleanup, and remains as unreadable to us as a live one.

Vault runs on Supabase (authentication and Postgres database) and is deployed on Vercel. They are our processors: they host the data described above, subject to their own security programs. Row-level security policies scope every database row to the account that owns it.

We send transactional email only: address confirmation on signup, and a one-time recovery link when you ask for one. Recovery emails carry no secrets — they prove control of your mailbox, which is one of the two factors recovery requires (the other is your printed recovery code, which never reaches us).

If you write to us through the landing page, your email address and message are delivered to us as an email and handled like ordinary correspondence. To keep abuse down we keep short-lived, per-IP rate counters for the form; they hold no message content.

There are no analytics scripts, no advertising pixels and no third-party trackers anywhere in the app. The only cookies are the ones the product needs: your session, and small UI preferences such as the sidebar state and theme.

Your data is kept for as long as your account exists. Encrypted backups you download are yours and outside our reach. If you want your account and its data removed, contact us and we will delete the account, its vault rows and its auth records; ciphertext in database backups ages out with the backup rotation and is undecryptable regardless.

Under the Philippine Data Privacy Act of 2012 (RA 10173) — and equivalent laws where you live — you can ask for access to, correction of, or deletion of the personal data we hold about you (your email and account records; the vault ciphertext we could only hand back as-is). Write to us and we will act on it.

If this policy changes, the effective date above changes with it. Material changes will be announced in the app.