WebVault Privacy Policy

Effective date: 2026-07-29
Data controller: Trinity Security, LLC
Applies to: the WebVault browser extension, the WebVault sync service, and the webvaultapp.com website.
Contact: support@webvaultapp.com

The short version

WebVault is built so that we cannot read what you save. Everything you put in your vault — pages, titles, notes, tags, collections, sessions — is encrypted on your device with keys derived from your passkey. Those keys never leave your device. If you enable sync, our server stores ciphertext it cannot decrypt. We show no ads and sell no data. The extension measures nothing about you: no analytics SDK ships in it, and an automated build check fails our release if one is ever added. This marketing website counts page views with a cookie-free script, described below. Most of these statements are enforced by architecture and automated tests, not just by this policy.

The website itself

This site sets no cookies and writes nothing to local or session storage. There is no advertising, no tag manager, no session recording, and no cross-site tracking. The typefaces, images, stylesheet and script are all served from this domain rather than from a CDN, so simply loading the page does not announce your visit to a third party.

One exception, disclosed in full: we run Cloudflare Web Analytics on this website to count page views and see which pages people reach. It loads a small script from static.cloudflareinsights.com. It sets no cookie, stores no persistent identifier, and does not follow you between sites or between visits — it reports aggregate traffic, not people. We use it to know whether the site works. That is the whole purpose.

The extension does none of this. No analytics SDK ships in WebVault itself, and an automated build check fails our release if one is ever added. Nothing about your vault, the pages you save, or how you use the extension is measured, counted, or transmitted.

Our infrastructure provider (Cloudflare) also processes transient connection data such as your IP address in order to serve the page and absorb attacks, as it does for any site it fronts.

What stays on your device

By default (no account, sync off), everything stays on your device: your saved content, your encryption keys, your settings. The extension makes no network requests to us at all. Saved content is encrypted at rest with AES-256-GCM; the vault unlocks with a passkey ceremony (Windows Hello, a hardware security key, or your phone) — no master password exists. Only TLS 1.3 is used for syncing, along with only cipher suites that are considered secure.

What we receive if you create an account and enable sync

Sync is opt-in. When you enable it, we receive and store:

• Your email address, via our sign-in provider, to identify your account.
• Encrypted vault records ("ciphertext") — we cannot decrypt them. Our server has no tables for plaintext URLs, titles, descriptions, tags, notes, collections, or session names; an automated test fails our server build if such a table is ever added.
• Envelope metadata needed to run sync: your vault and device identifiers, device labels you choose, record counts and sizes, sequence numbers, and timestamps.
• Subscription status (see Payments).
• Transient connection data (such as IP addresses) processed by our infrastructure provider (Cloudflare) to serve requests and prevent abuse.

What we can infer from this is limited to usage envelope — roughly how much you save and when you sync, never what you saved.

What we can never access

• Your vault contents. Encryption keys are derived from your passkey's PRF output on your device; the server never sees a key or a plaintext record.
• Your passkey. It lives in your authenticator (Windows Hello, security key, or phone).
• Your recovery file. Generated and downloaded locally; we never receive it.

A consequence you should understand: we cannot recover your vault. If you lose every enrolled passkey and your recovery file, your data is cryptographically unrecoverable — by us or anyone else. That inability is the privacy guarantee working as designed.

Payments

Paid plans are processed by Stripe. Your card details go directly to Stripe and never touch our systems; we receive only your subscription status and a customer reference. Stripe's privacy policy applies to the payment itself.

Third-party services we use

We use no advertising networks, no session-recording tools, and no cross-site trackers. Our only measurement is the cookie-free page-view count on the marketing website described above. An automated build check asserts no analytics SDK ships in the extension itself.

Optional features that make network requests

Off by default; each is a visible setting:

• Dead-link checking (Pro): when you turn it on, the extension sends HEAD requests to the sites you've saved to see if they still exist. Those requests go to the saved sites (not to us) and carry no cookies or identifying headers beyond your IP address.
• Push notifications for device approvals: uses your browser's push service to deliver a content-free wake-up signal. The payload never contains vault data.

Data retention and deletion

Deleting your account schedules cryptographic erasure of your data within 30 days, after which the ciphertext and its metadata are gone. You can export your complete vault at any time (encrypted .wvlt file) — your data is yours to take with you. Local data on your devices is deleted by removing the extension or clearing its storage.

Your privacy rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you.
• Correct it, if it is wrong.
• Delete it, by closing your account (see Data retention and deletion).
• Export your vault at any time, as an encrypted .wvlt file.
• Withdraw consent and stop using the service, without penalty.

The personal information we hold is limited to your email address, your subscription status, and the envelope metadata described above. Your vault contents are not part of an access request, for the plain reason that we cannot read them — export the vault from the extension instead, where the keys are.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. We do not run targeted advertising, we do not profile you, and we do not use your information to infer characteristics about you. We do not collect sensitive personal information.

To make a request, email support@webvaultapp.com from the address on your account. We will respond within 45 days; if we need longer we will tell you why before that deadline passes. Making a request costs nothing, and we will not degrade your service for asking.

Appeals. If we decline a request, we will tell you why, and you may appeal by replying to that decision. We will review it and give you a written answer. If we deny the appeal, you may complain to your state Attorney General or to your data protection authority.

Authorised agents. You may have someone make a request on your behalf. We may ask you to confirm that you authorised them.

If you are in the EEA or the UK. Our legal basis for processing your email address and subscription status is performance of your contract with us; for transient connection data it is our legitimate interest in serving and defending the service. You may also lodge a complaint with your local supervisory authority.

What we do not promise

In the interest of honesty:

• Not anonymity. A network observer can see that your IP talks to our sync server, even though the contents are unreadable.
• Not immunity to legal process. We can be compelled to hand over what we have — which is, by construction, ciphertext and envelope metadata.
• Not protection from a compromised device. Malware running on your device while your vault is unlocked can access what you can access. This is true for any product, no matter how secure.

Children

WebVault is not intended for anyone under 16, and our Terms of Service require you to be at least 16 to use it. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email support@webvaultapp.com and we will delete it.

Changes to this policy

We will post changes here with a new effective date. Material changes that affect what we collect will be called out in the extension's release notes.

Verifying our claims

Our security architecture, threat model, and cryptographic specifications are documented publicly, and the enforcement mechanisms (CI tests, build-time scans) live alongside the code. The claims in this policy are the enforced kind.