Terms of service.

Vault is a zero-knowledge password manager: your logins, notes and cards are encrypted on your device with keys derived from a master password we never receive, and the service stores and syncs the resulting ciphertext. "Zero-knowledge" is a commitment about architecture, not just intent — the server has no mechanism to decrypt what you store.

You need an email address you control, and you must confirm it. That is not bureaucracy: control of your mailbox is one of the two factors that can recover your vault, so an address you cannot read makes recovery impossible. Keep it current.

We cannot reset, recover, or bypass your master password, and no support request can change that. The Emergency Kit — a printed recovery code plus your email — is the only way back in if you forget it. Generating it, storing it safely, and re-issuing it if it is ever exposed are your responsibility.

Don't abuse the service: no attempts to access other users' data, probe or overload the infrastructure, or use Vault to store or coordinate material that is illegal in your jurisdiction or ours. Rate limits and row-level security are guardrails, not a challenge.

You own everything you store. We take only the limited license required to operate the service — storing, transmitting and backing up your ciphertext. We could not use your vault contents for anything else even if the license said otherwise, because we cannot read them.

Vault is provided on a best-effort basis without an uptime guarantee. Mitigate the risk the same way we do: export. An encrypted backup (safe to store anywhere) or a plaintext CSV (for migrating away) is available from Settings at any time. There is no lock-in by design.

The service is provided "as is". The cryptographic design is documented and the client is auditable, but we make no warranty that the service is error-free or fit for a particular purpose.

To the maximum extent Philippine law allows, our liability for any claim arising from the service is limited to the amount you paid for it (currently: nothing). In particular, a forgotten master password combined with a lost Emergency Kit means the data is unrecoverable — by us, by you, by anyone — and we are not liable for that loss.

You can stop using Vault and request account deletion at any time — export first. We may suspend or terminate accounts that breach these terms, with export access preserved where lawful and practical.

These terms are governed by the laws of the Republic of the Philippines, with venue in Manila. If the terms change materially, the effective date above changes and the update will be announced in the app; continued use after that is acceptance.