Privacy at VaultX

Updated 30 October 2026. VaultX is a pre-release personal password manager. Use synthetic passwords until its independent security review is complete.

Your encrypted vault

Entry titles, usernames, passwords, websites, and notes are encrypted in your browser. The service stores the encrypted document, wrapped encryption keys, and the metadata needed to synchronize it. Your master passphrase and offline vault recovery key are not sent to the service. The service cannot reset these secrets or decrypt your vault for you.

Account and security information

Google sign-in provides your Google account identifier, name, email address, profile image, and email verification status. VaultX uses this information to identify your account. It also stores authentication sessions, authentication activity needed for rate limits, encrypted authenticator seeds and OAuth tokens, and hashes of single-use authenticator backup codes. Session records may include IP addresses and browser information. These authentication records are separate from your encrypted vault.

Service providers

Google provides sign-in. Vercel hosts the application, and Neon stores its PostgreSQL database. These providers process information needed to deliver their services, including network and operational metadata. VaultX does not include advertising, third-party analytics scripts, or session-replay scripts in its vault interface.

Browser storage and limitations

Authentication uses cookies. Unlocked vault contents and encryption keys are kept in browser memory, not persistent browser storage. Downloaded encrypted backups and copied clipboard contents remain under your control. Compromised devices, browser extensions, or malicious application code can expose an unlocked vault.

Retention and requests

Account and encrypted vault records are retained while the account exists. The interface supports encrypted vault export and deletion of individual entries. Removing an entry from the current vault does not erase copies in previously downloaded backups or provider backups. There is currently no self-service account deletion screen. Contact the operator for account access or deletion requests; do not include passwords, recovery keys, or authenticator codes in your message.

Contact: smshmhnt@gmail.com