Privacy Policy

Overview

KeepInVault is a zero-knowledge password manager. Your master password and vault encryption key are never transmitted to us, and everything sensitive you store — passwords, card numbers, notes, TOTP secrets — is encrypted on your device before it ever reaches our servers. This policy explains, in plain terms, the narrow set of data we do handle and why.

Information we collect

• Account details: your email address, and a bcrypt hash of the authentication key your device derives from your master password. We never receive the master password itself.
• Encrypted vault items: AES-256-GCM ciphertext and its initialization vector for every login, card, note, and TOTP secret you save.
• Item names and domains: unlike the credential data above, an item's name (e.g. "GitHub") and domain (e.g. "github.com") are stored as plain text. This lets your vault list render, and the autofill and password-health features work, without any server-side decryption. Usernames, passwords, card numbers, and notes are never included in this plain-text metadata.
• Session metadata: device name, IP address, browser user agent, and timestamps, so the Sessions page can show you every place you're signed in and let you revoke access.
• Share link metadata: a random link ID, expiry time, view count, and a bcrypt hash of the optional PIN. The decryption key for a shared item lives only in the link's URL fragment, which your browser never sends to our servers — we cannot decrypt what you share.
• Team/organization data: membership roles and invite email addresses, if you create or join a team vault.
• Referral relationships: which account referred which, and whether a referred account is on an active paid plan, so we can calculate the referral reward.
• Billing status: your plan name and subscription status. Card numbers and billing details are collected and stored directly by Stripe, our payment processor — we receive only a status update, never your card details.
• Security audit events: logins, password changes, and similar account events, used to detect unusual sign-ins and email you a heads-up.

What we never see

• Your master password
• Your vault encryption key — derived and held only in your browser or device, never transmitted
• The plaintext contents of any login, card, note, or TOTP secret
• Decryption keys for anything you share via a share link
• Your card details, if you subscribe to Pro (handled entirely by Stripe)

AI password-health insights

The Pro password-health feature runs on a language model we self-host on our own infrastructure — not a third-party AI API. Only metadata leaves your account for this feature: item counts, domains, item names, and how long ago each credential was last updated. Passwords, notes, card numbers, and TOTP secrets are never included in what's sent for analysis, and the model never sees decrypted vault contents.

How we use this data

We use it to operate the service: authenticating you, showing you your own sessions and share links, calculating referral rewards, processing billing through Stripe, and sending account-related emails — welcome and verification messages, share-link and unusual-login alerts, team invitations, and referral reward notices. We don't send marketing email without your consent, and we don't sell or rent your data.

Data retention and deletion

We keep your account data for as long as your account exists. Self-serve account deletion isn't built into the product yet — until it is, email us at support@keepinvault.com and we'll permanently delete your account, vault items, sessions, and share links by hand.

Your rights

Wherever you're located, you can ask us to access, correct, or delete the data described above, or to export your encrypted vault. Because your vault is encrypted end-to-end, an export contains ciphertext you can re-import elsewhere — we have no way to hand you a decrypted copy, by design.

Changes to this policy

If we make a material change to this policy, we'll update the date above and, for significant changes, email the address on your account.

Contact

Questions about this policy or your data — reach us at support@keepinvault.com.