Cookie Policy

Last updated: 30 July 2026

This policy is short because Vault3 sets exactly one cookie.

1. The one cookie

When you sign in, we set a single cookie of our own named vault3_session. All it holds is a long random value that means nothing anywhere else, and we keep only a fingerprint of it rather than the value itself. It is strictly necessary: without it you could not stay signed in.

• Name: vault3_session
• Purpose: keeping you signed in to your account
• Lifetime: 30 days, or until you sign out
• Attributes: HttpOnly, Secure (in production), SameSite=Lax

That is the only cookie Vault3 sets. No analytics cookies, no advertising cookies, and nothing belonging to anyone else.

2. What stays on your device

The app also keeps a little information in your browser's own storage. It never leaves your device:

• A remembered device — your email address and Secret Phrase, held locally so you do not have to type them again on a device you trust.
• Your unlocked keys — while the vault is open, the keys that decrypt your items live in the browser tab so the app can read them. They are thrown away when the tab closes, when you lock, and when you sign out.

Clearing site data for vault3.com in your browser removes all of it. You would just sign in and unlock again.

3. Why we tell you rather than ask you

Consent banners exist because most websites follow their visitors around. We do not. Our one cookie is strictly necessary to keep you signed in, and under UK and EU law that kind needs no consent — so there is genuinely nothing to ask you about.

The little notice on your first visit says that and no more: one button to acknowledge it, nothing to configure, nothing recorded on our side. Dismissing it leaves a single flag in your browser so it does not come back.

4. Questions

Vault3 is made and run by Octa Systems Ltd, trading as Octa Digital (octa.sh). If anything here is unclear, email [email protected].