Legal

Privacy Policy

Last updated: June 10, 2026 (Pre-alpha)

Pre-alpha notice: Vaultlane is pre-alpha software. Don't store real passwords yet. This policy describes how Vaultlane is designed to handle data, and applies to Vaultlane Cloud (the hosted service at vaultlane.app) once it launches. If you self-host Vaultlane, you are the data controller. This policy doesn't apply to your instance, and no data is ever sent to us.

The short version

Vaultlane is a zero-knowledge password manager. Your vault items (passwords, notes, card numbers, etc.) are encrypted and decrypted only on your devices, using a key derived from your master password. We never have your master password and never have the keys needed to read your vault. A full copy of our database would give an attacker only your email address and unreadable ciphertext. See our security spec for the technical details.

What we collect (Vaultlane Cloud)

Data	Why	Can we read it?
Email address	Login identifier, account recovery, service emails	Yes, plaintext
Password hint (optional)	"Forgot master password" first aid	Yes, plaintext (only ever emailed back to you)
Encrypted vault items (ciphertext)	Sync across your devices	No, encrypted client-side with a key we never receive
Device name, platform, last-seen time	Show "your devices" list, let you revoke a lost device	Yes, plaintext
KDF parameters & salts, wrapped vault key	Required for you to derive your encryption key	Yes, but useless without your master password
TOTP secret (if you enable login 2FA)	Verify 2FA codes at login	Yes, stored server-side; this is independent of your vault encryption
Server logs (IP address, timestamps, request paths)	Abuse prevention, rate limiting, debugging	Yes, retained briefly, not sold or shared

We do not collect: vault item contents, your master password, analytics / tracking identifiers, or any data for advertising. Vaultlane has no ads and no third-party trackers.

What we never see

Because encryption and decryption happen entirely on your device:

We cannot read your saved passwords, notes, card numbers, or any other vault item content.
We cannot reset your master password for you (that's what the Recovery Kit, generated on your device, is for).
A government request, subpoena, or data breach against us could only ever expose your email address and ciphertext we cannot decrypt.

Email delivery

If you register with a real email address, we send transactional email (verification codes, password hints, security notices) via our SMTP provider. We don't use email for marketing unless you explicitly opt in.

Data retention & deletion

You can delete your account at any time from Settings. This immediately and permanently deletes your account record, all vault items, devices, and sessions from our database.
Server logs are retained for a limited period for security purposes and then rotated out.

Children

Vaultlane is not directed at children under 13 (or the relevant age of digital consent in your jurisdiction), and we do not knowingly collect data from them.

Changes to this policy

We'll update the "last updated" date above and, for material changes, notify account holders by email before the change takes effect.

Contact

Questions about this policy: support@vaultlane.app

Security vulnerability reports: support@vaultlane.app (see our security spec for our disclosure policy)

This document describes Vaultlane's intended privacy practices ahead of public launch and has not yet been reviewed by a lawyer. It will be revised before Vaultlane Cloud accepts real user data.