Secure PasswordVault Privacy Policy

Effective date: October 10, 2026

Last updated: October 10, 2026

This Privacy Policy explains how Secure PasswordVault ("Secure PasswordVault," "we," "us," or "our") handles information in connection with the Secure PasswordVault desktop application, our public website, support, and any Secure Search feature we may make available. It does not describe the practices of independent websites or services you choose to visit.

1. Our privacy approach

Secure PasswordVault is designed so that your vault remains on your device. In the current release, saved credentials, usernames, websites, notes, tags, cryptographic keys, and your master password are not sent to a Secure PasswordVault cloud-vault service. Cloud Backup and Cloud Restore are not currently available.

We do not sell vault contents. We do not use vault contents for advertising, analytics, or profiling.

2. Information handled on your device

The application may process the following information locally to provide features you request:

• vault items, including service names, usernames, passwords, website addresses, notes, tags, and favorites;
• security findings, such as weak, reused, or known-compromised password indicators;
• application preferences, security settings, and session activity shown inside the application;
• imported data that you select, and files that you choose to export;
• local cryptographic material and authentication state required to encrypt and unlock your vault.

Your master password is used locally to unlock cryptographic material. Secure PasswordVault cannot retrieve or reset it for you. When Windows Hello is available and you enable it, authentication is performed through Windows and the local VaultCore integration. Secure PasswordVault does not receive your fingerprint, face template, PIN, or other biometric data.

3. Clipboard, reveal, import, and export

Passwords remain masked until you take an explicit action. Reveal and copy actions may require authentication. If you copy a username, password, recovery value, or other sensitive data, it is placed on the Windows clipboard and can be accessible to Windows or other applications until it is cleared. Secure PasswordVault may attempt to clear sensitive clipboard content after the period you select, but clipboard clearing cannot prevent every operating-system or third-party access.

When you import a Chrome, Edge, or supported CSV password file, the application processes the file you select locally. Browser-exported CSV files contain plaintext credentials and should be deleted securely after import. Secure PasswordVault exports the complete vault only as an encrypted portable package. You are responsible for protecting exported packages, the associated Recovery Kit, and the master password used by the exported vault.

4. Password exposure checks

The Secure PasswordVault application may compare locally derived password fingerprints with a third-party breached-password database. The application sends only a short prefix derived from a one-way password digest. It does not send the password, the complete digest, vault identifiers, usernames, or saved website details for this check. The complete comparison remains on your device. The provider receives ordinary network information such as your IP address and request metadata, as it does for other internet requests.

Our public Email Breach Check accepts an email address only in your browser. When you continue, client-side code opens the supported Have I Been Pwned account-result URL for the address. The address is sent directly to Have I Been Pwned, is visible in that destination URL and may remain in your browser history, and is handled under Have I Been Pwned's terms and privacy policy. Secure PasswordVault does not receive, store, or add the address to its own website URL, and the page does not send the address to analytics.

Our public Password Generator uses your browser's cryptographically secure random-number generator and does not transmit generated passwords to Secure PasswordVault. Values you copy are subject to your browser, operating system, clipboard, and other software on your device.

Weak-password and reused-password analysis is performed locally.

5. Website and operational information

When you visit our website or request online resources, our hosting and security providers may process routine technical information such as IP address, browser and operating-system type, requested URL, referring page, timestamps, response status, and security or diagnostic events. We use this information to deliver and protect the service, troubleshoot problems, and prevent abuse.

Operational and server logs are retained only for as long as reasonably necessary to deliver and protect the website, troubleshoot problems, prevent abuse, or comply with applicable law. Retention may also depend on the hosting and security providers used for the website.

6. Support communications

If you contact support, we process the information you choose to provide, such as your email address, message, and attachments. Do not send passwords, recovery codes, vault exports, cryptographic keys, or other vault secrets to support.

Support correspondence is retained only for as long as reasonably necessary to answer the request, maintain service records, resolve disputes, protect users, or comply with applicable law.

7. Analytics and diagnostics

The current Secure PasswordVault release does not collect application usage analytics and does not upload application crash reports. If these practices change, we will update this Policy and provide notice or controls where required.

We do not permit analytics to receive passwords, recovery codes, encryption keys, clipboard contents, complete password digests, usernames stored in your vault, or vault notes.

8. Secure Search

Secure Search and related browser features may process search queries, destination or domain information, and routine request data needed to provide, configure, secure, and improve those features. They may rely on independent search, advertising, security, or threat-intelligence providers whose handling of information is governed by their own terms and privacy policies.

Secure Search information is not combined with vault contents to determine whether you have a matching saved credential. We will provide any additional notice or choices required by applicable law.

9. When information may be shared

We may disclose the limited information described above:

• to hosting, security, support, analytics, search, or infrastructure providers acting for us;
• to comply with law, valid legal process, or enforceable governmental requests;
• to protect users, Secure PasswordVault, or others from fraud, abuse, security threats, or harm;
• as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections; or
• with your direction or consent.

Because current-release vault contents remain on your device, we ordinarily do not possess them to disclose.

10. International processing

Our providers and personnel may process limited website, operational, or support information in countries other than the one where you live. Where required, we use contractual or other lawful safeguards for international transfers. Local privacy laws may differ from those in your jurisdiction.

11. Security

We use administrative, technical, and organizational safeguards appropriate to the information we handle. No application, device, storage method, or internet transmission can be guaranteed completely secure. You are responsible for securing your device, master password, recovery materials, and exported files.

12. Your choices and rights

You may change application preferences, stop using Secure PasswordVault, remove the application, or delete local application data using the controls made available by Windows and Secure PasswordVault. You may contact us to exercise privacy rights that apply in your jurisdiction, which may include rights to access, correct, delete, restrict, or object to our processing of information we hold about you. We may need to verify your request.

These rights cannot give us access to vault contents that remain only on your device.

13. Children

Secure PasswordVault is not directed to children under 13. You must be at least 13 to use the service. If you are below the age of legal majority where you live, you may use Secure PasswordVault only with permission from a parent or legal guardian. If we learn that we collected personal information from a child in violation of applicable law, we will take reasonable steps to delete it.

14. Changes to this Policy

We may update this Policy as the product, law, or our practices change. We will post the updated version and revise the date above. We will provide additional notice when required by law or when a change materially affects how we handle personal information.

15. Contact

Privacy questions and requests: [email protected]

Support: [email protected]