Privacy Policy

Last updated: August 2026

Vault is a zero-knowledge password manager. This policy applies to the Vault browser extension and the Vault sync server at vault.b-hayes.com.

What data we collect

The Vault server stores only the following:

• Your username
• A bcrypt hash of your authentication verifier (derived from your master password - we never see the password itself)
• Your encrypted vault (ciphertext only - we cannot read your passwords or notes)
• Bearer tokens for extension authentication, stored hashed

What we cannot see

Vault is zero-knowledge. Your master password, Secret Key, and all vault contents (passwords, usernames, URLs, notes) are encrypted on your device before being sent to us. We have no ability to read them.

What the extension does

The Vault browser extension:

• Communicates only with vault.b-hayes.com
• Reads the current tab's URL to match saved credentials for autofill
• Stores your encrypted vault and session token locally in browser storage
• Never sends data to any third party

Data sharing

No data is shared with any third party. Vault has no analytics, no telemetry, and no external service integrations.

Contact

Questions? Open an issue on the Vault GitHub repository.