Privacy policy

Two separate things

This website and the Vaultwarden servers are two separate systems. The site presents the project; the servers host the vaults. They do not process the same data, and this page covers both.

What the website records

No analytics cookie, no tracker, no third-party service. Visits are counted using a fingerprint derived from the IP address and the browser, salted and regenerated every day: it cannot recognise you from one day to the next, and the IP address is never stored. Also recorded: the page viewed, the language displayed, the country estimated from browser preferences, and the site you came from. All of it is deleted beyond the retention period stated below.

Cookies

A single cookie is set, and only if you pick a language from the menu: it remembers that choice for a year. It is not used to track you. The light or dark theme is stored by your browser, without a cookie.

Contact form

Messages sent through the form are kept for as long as it takes to handle the request. They contain the email address you provide, which is used only to reply to you and is never sold or used for anything else.

What the vault servers keep

Your vault is encrypted on your device before anything is sent. The administrator holds no key and therefore cannot read your passwords. The server keeps your email address, your account's encryption settings, a hash used to verify login, and the encrypted block of your vault. Technical logs required for operation are kept briefly.

Retention periods

Visit statistics: 400 days. Availability checks: 90 days. Administration log: 365 days. Your account data is kept for as long as the account exists.

Your rights

You can export your entire vault from the app at any time, and delete your account from the web vault: deletion is immediate and final. For any question about your data, or to exercise your rights of access, rectification, erasure and objection, write to us. You may also contact the data protection authority in your country.

Legal notice Terms