Privacy

Who runs Vault

Vault, at vault.nbergesen.com, and the Vault extension for Microsoft Edge are run by Nicholas Bergesen. The service is hosted in South Korea.

For any question or request about your data, including access, correction, or deletion, email nicholasb.za@gmail.com.

How your secrets are protected

Vault encrypts every secret you store, including passwords, notes, fields, and vault and collection names, with AES-256-GCM. The keys form a hierarchy rooted in a key kept outside the database and outside the application image.

Vault is server-trusted, not zero-knowledge. The service decrypts your secrets when you, your browser extension, or an agent key you created is signed in and allowed to read them, so that it can show or fill them. The operator of the service is therefore technically able to access stored data, and does not do so except to run and secure the service or when you ask.

What Vault collects

Your account

• Your email address.
• Your password, stored only as a salted, one-way hash. Vault cannot read it back.
• Your two-step verification secret, stored encrypted, and your recovery codes, stored only as hashes.
• If you sign in with Google: your Google account identifier and the email address Google reports. Vault does not keep Google access or refresh tokens.
• Your preferences, such as theme, session timeout, password generator settings, and which optional security emails you receive.

What you store

The vaults, collections, and entries you create, and earlier versions of entries you change or delete, all encrypted as described above.

Sign-in sessions and activity

For each signed-in session, Vault stores the IP address and browser user agent string the session was most recently used from.

For each action recorded in your activity log, such as signing in, revealing a secret, or an extension fill, Vault stores the time, the kind of action, which item it concerned, whether it succeeded, whether it came from the website, the extension, or an agent key, and your IP address and user agent. The activity log never contains the secrets themselves. You can review your own activity on the Activity page, and the operator can see activity records when running and securing the service.

Browsers you sign in from

When you sign in, Vault records the browser in a cookie so it can tell a browser you have used before from a new one. It stores a random identifier for the browser, a one-way hash of the cookie's secret, when it was first and last seen, and whether it was confirmed by your second factor. It stores no name, address, or user agent for the browser.

Security emails

When something happens to your account that you may want to know about, Vault queues an email to your address. The queued record holds which kind of event it was, when it happened, and the family of browser and operating system it came from, such as Firefox on Windows. It holds no email address, IP address, user agent, or anything you store.

Web server logs

The web server in front of Vault logs each request with your IP address, browser user agent, the time, and the address requested. For the browser extension, the address requested includes the web address of the site being filled. These logs are used only to run and secure the service.

The browser extension

• A record of each browser you connect: its name, a public key used to prove requests come from it, its status, and when it was connected and last used. Vault also keeps a record of each request to connect a browser, with the same name and public key.
• When a page you open has a login form, the extension sends that site's web address (for example https://example.com) to your Vault to look for a saved login. It does not send the page's path, content, or anything you type.
• The username and password it fills are sent from Vault to the extension only at the moment of filling. The extension does not store them, and it never submits forms for you.
• When you open the extension's toolbar button on a page with a card form, the extension lists your saved payment cards by title, card brand, and last four digits, and names each payment provider frame the card would go into. To find card fields inside those frames, its card script runs in every frame of a site you granted it, and tells the extension which kinds of card field it found, whether the frame can be seen, and the sites of the frames above it. The sites of those frames leave your browser only as described here: when you open the toolbar button on a card form, when a card form appears, when you turn on Always fill this card, and when you press Fill card. When you install the extension, or update to the version that added it, your browser asks for a permission it words as reading your browsing history, because the extension cannot fill a card into a payment provider's frame without knowing which page that frame belongs to. The extension uses that permission only to list the frames of the tab you open its toolbar button on, or of a tab whose page shows a card form, and never to follow your browsing. When you press Fill card, it sends that site's web address and the web address of each frame's site, without its path, to your Vault, and the chosen card's name, number, expiry date, and security code are sent from Vault to the extension only at the moment of filling. The extension does not store them, never submits the payment, and never presses a button on the page. For each card it releases, Vault records the fill's outcome, with how many frames and which kinds of card field were filled, against keyed hashes of those addresses, never the card values.
• From the same toolbar button you can turn on Always fill this card on a site, for that exact site only. Turning it on fills the card form in front of you straight away, as pressing Fill card would. Vault then keeps, for that browser, which card to fill there and the sites of the frames it may go into, against keyed hashes of those addresses rather than the addresses themselves. To know when to fill, whenever a card form appears on a secure site, and when you open the toolbar button on one, the extension sends that site's web address to your Vault, with the sites of the frames that would receive the card, to ask whether you turned it on there. On a site you turned it on for, the card goes in whenever its card form appears, without a press, and only into the frames you were shown; a card field in any other frame stops it. Turning it on, turning it off, and a Fill card press changing its frames are recorded with the card they name. Turning it off stops it at once. The extension keeps the address of each site you turn it on for in your browser, so that its settings page can list those sites and let you turn any of them off without opening it. That address is removed when you turn the site off, when the extension learns Vault no longer has that setting, or when the browser is disconnected, and is never sent to Vault to make the list.
• Which saved login you chose for a site, and the outcome of each fill, kept against a keyed hash of the site's address rather than the address itself. If a site has been paused, Vault keeps that site's address so it knows not to fill there.
• The extension stores its settings and encrypted sign-in tokens in your browser. While the browser is open it also keeps, for each tab, the browser's random identifiers for the pages it has filled or tried to fill a card into automatically or when you turned a site on, and for a page where a refused card fill may have left the card, with why a fill you started by turning a site on was refused, so that it does not fill a page automatically a second time and can tell you about the refusal. They hold nothing from the page and are not written to disk. They are cleared when the browser closes, and those for a tab you closed are cleared the next time the extension starts its background work. It includes no analytics and sends nothing to anyone other than your Vault.

Agent keys

For access keys you create for tools and agents: the key's name, permissions, scope, and when it was created and last used. Vault stores a short identifier shown on the Security page and a hash of the key, never the key itself.

What Vault does not do

• It does not sell or rent your data, or share it for advertising.
• It uses no analytics, advertising, tracking cookies, web fonts, or content delivery networks, and its emails contain no tracking images.
• The extension does not record your browsing history, read the content of the pages you visit, or submit forms.
• It does not use your data to assess creditworthiness or for lending.

Other services that receive data

• Google, only if you choose to sign in with Google. Google handles that sign-in and tells Vault your name, profile picture, email address, and Google account identifier. Vault keeps only the identifier and the email address.
• Cloudflare Turnstile, on the registration and account recovery pages, to tell people from automated abuse. Your browser loads Cloudflare's check, and Vault sends Cloudflare the check's result token and your IP address to verify it.
• Mailtrap, which delivers Vault's emails: address verification, account recovery, and account deletion messages, and security emails about your account. It receives your email address and the message.
• Have I Been Pwned, to warn you about breached passwords. It receives only the first five characters of a password's SHA-1 hash, never the password, when you register or recover your account.

Cookies

Vault uses only the cookies it needs to work: a sign-in cookie that expires within 24 hours and sooner when you are idle, short-lived cookies that carry you between the steps of signing in, a cookie that protects forms against cross-site request forgery, and a cookie that lets Vault recognise a browser you have signed in from, which expires after 90 days and is renewed each time you sign in. There are no tracking or advertising cookies.

How long data is kept

• Your account and what you store: until you delete them or your account. An entry you delete stays in Trash for 30 days before it is removed. Approving an agent's request to delete an entry, or deleting a whole vault, removes those entries immediately.
• Web server logs: kept by the server's log storage and not yet deleted on a fixed schedule.
• Sign-in session records, with their IP address and user agent: for as long as your account exists.
• Earlier versions of an entry: until they are more than 90 days old or more than 25 versions back.
• Activity log records, with their IP address and user agent: 365 days.
• Extension sign-in: at most 90 days before the browser must be connected again. Records of individual fill attempts and short-lived access tokens are deleted within a day of expiring. The record of each browser you connected, its sign-in records, the saved login you chose for each site, any site pauses, and the record of each change to a site's automatic card fill are kept for as long as your account exists. A site's automatic card fill setting is kept until you turn it off or disconnect that browser, or, once its card is no longer an active card in your account, until the extension next asks about that site; a card restored from the trash before then keeps it. A record of each request to connect a browser, with the browser's name, is not yet deleted on a fixed schedule and is not removed when your account is deleted.
• Browsers you sign in from: a browser not seen for 90 days is no longer recognised, and its record is removed the next time Vault records a browser for your account. Every record is removed when you forget your browsers from the Security page, when your account is recovered, suspended, or scheduled for deletion, and when it is deleted.
• Security emails: Vault stops trying to send a queued email at most 24 hours after its event. The record of an email sent or given up on is deleted 7 days later, so the operator can see what was or was not delivered. Every record is removed when your account is deleted. When it is suspended or scheduled for deletion, records still waiting are removed unless they report a change no setting can silence.
• Which optional security emails you receive: for as long as your account exists. Recovering your account turns them all back on.
• When you delete your account, Vault waits 7 days so you can cancel, then deletes the account and what you stored. Activity log records are kept for the rest of their retention period, after your account and its email address have been deleted. Records of requests to connect a browser also remain, as described above.
• Encrypted backups of the service are kept for up to about eight weeks, so deleted data can remain in a backup for that long.

Your choices

• Review your activity on the Activity page.
• Export your data as a CSV file or an encrypted backup from the Import and export page in settings.
• Revoke a signed-in session, an agent key, or a connected browser from the Security page.
• Turn the extension's autofill off from its toolbar button, or disconnect the browser from the extension's settings.
• Delete your account from the Account page.
• Ask for a copy, correction, or deletion of your data, or ask anything about this policy, at nicholasb.za@gmail.com.

Changes to this policy

When what Vault collects or shares changes, this page is updated and its effective date changes with it.