Privacy Policy

This Privacy Policy explains what information Vaultherit collects when you use our website and app, why, and what we do — and deliberately don't do — with it. The short version: we collect what's needed to run your account and process purchases, and we are structurally unable to see the contents of your vault, ever.

1. Information we collect

Account information — the name, email, and mobile number (required) you provide at signup — used to contact you about your account, orders, licences and support; your password, stored only as a salted hash, never in plain text.

Payment information — handled entirely by Razorpay, our payment processor. We receive confirmation that a payment succeeded and its amount; we never receive or store your full card or bank account number.

Security & activity information — IP address, browser/device info, and timestamps for login attempts (used for the new-device alerts and Active Sessions list in your Dashboard); order and license history; referral relationships and wallet transactions; notifications we've shown you.

Optional cloud backup — if you turn this on in the app, we store the already-encrypted vault file bytes you upload. We cannot decrypt them.

Optional dead-man's-switch check-ins — if you enable this feature in the app, we store a device identifier, your chosen nominee's email, and your chosen silence threshold, so we can notify that nominee if your device goes silent past the threshold you set. We never store vault contents as part of this.

License activation — when you activate a license key in the app, we store a randomly generated device identifier (not derived from any hardware serial or advertising ID) alongside the key, so we can enforce one active device per license and so you can self-service "Reset device binding" from your Dashboard.

Aggregate site traffic — a first-party, cookieless pageview counter: which page was viewed and the referring site's domain (e.g. "google.com"), tallied per day. No IP address, no cookie, and no per-visitor identifier of any kind is stored, so there's no "unique visitor" count and nothing here is ever tied back to an individual — only totals an admin can see (e.g. "40 views of the pricing page yesterday"). No third party is involved in collecting this.

Support communications — anything you send us directly, e.g. by email.

2. How we use it

To create and secure your account; to process purchases and issue license keys; to run the referral program (crediting commissions, processing payouts); to alert you to security-relevant activity (new-device sign-ins, payout confirmations, order confirmations); to respond to support requests; and to comply with legal obligations (e.g. basic transaction records for accounting/tax purposes). We do not use your information for advertising, and we do not run behavioral tracking or ad pixels on this site.

3. Who we share it with

We share information only with the service providers needed to run Vaultherit, each bound by their own security and privacy commitments:

• Razorpay — payment processing.

• Cloudflare — hosts our license server, the optional encrypted-backup storage, and related infrastructure.

• Resend — delivers transactional emails (order confirmations, password resets, security alerts), where email delivery is enabled.

• Have I Been Pwned (haveibeenpwned.com) — if you use the app's password-breach check (the manual "Check for compromised passwords" button, or the optional weekly automatic check — both off unless you use them), only the first 5 characters of a SHA-1 hash of a saved password are sent to this service, using k-anonymity. The password itself, or its full hash, never leaves your device.

• Sentry — optional and off by default. If you turn on crash reporting in the app's Settings and supply your own Sentry project's DSN, anonymous crash stack traces and error messages (never personal data, screenshots, or vault contents) are sent to that Sentry project so you can diagnose crashes.

We never sell your information, and we never share it with third parties for their own marketing purposes.

4. How long we keep it

We keep account information for as long as your account is active, plus a reasonable period afterward for accounting, tax, and fraud-prevention purposes. Encrypted cloud backups are kept until you delete them from the app or close your account. If you request account deletion (Dashboard → Security → Account & Data), we review and act on it manually rather than instantly — this is intentional, so a deletion is never carried out by mistake or by someone else pretending to be you.

5. Your rights

You can, at any time from your Dashboard:

• Export your data — Security → Account & Data → "Export my data" downloads a JSON copy of your account information, orders, referrals, and activity history.

• Correct your information — Profile lets you update your name and phone number at any time.

• Request deletion — Security → Account & Data → "Delete my account."

6. Security measures

Passwords are hashed, never stored in plain text. Optional two-factor authentication (authenticator app) and Face ID/Fingerprint (WebAuthn) sign-in are available for your account. We log in-app security events (new-device sign-ins, password changes) and let you review and revoke individual active sessions. Your vault file itself is protected independently of all of this, using Argon2id key derivation and XChaCha20-Poly1305 authenticated encryption entirely on your own device — see our Security page for the technical details.

7. Cookies

This site uses a single functional session cookie to keep you signed in. We don't use third-party advertising or tracking cookies. The aggregate traffic counter described above (section 1) doesn't use a cookie at all, by design.

8. Children's privacy

Vaultherit isn't directed at children, and accounts require you to be at least 18 (or the age of majority where you live). We don't knowingly collect information from children.

9. International users

Our infrastructure is hosted with providers that operate data centers internationally. By using the Service, you understand your information may be processed outside your own country.

10. Changes to this policy

We'll update the "Last updated" date above whenever this policy changes, and post the updated version here.

11. Contact

Questions about this policy, or a request regarding your data? support@vaultherit.com