vault3

Privacy Policy

Last updated: 30 July 2026

This policy is unusually short, for one reason: there is very little about you here to write about. It sets out what we can and cannot see, what we do hold and why, how long we keep it, and what you can ask of us. The data controller is Octa Systems Ltd, trading as Octa Digital — the company that makes and runs Vault3 — and you can reach us at [email protected].

1. Why this policy is short

Your vault is locked on your device before it is sent to us, with a key made from your Master Password and your twelve-word Secret Phrase. Neither of those reaches us in a form anyone could use, so what we hold is a locked copy and no way to open it.

Most privacy policies ask you to trust how a company behaves with your data. This one mostly describes data we could not misuse if we wanted to: we cannot read your vault, we cannot pass it on in readable form, and no request, court order or change of ownership can turn locked text into readable text. It is not a policy we could quietly reverse — it is how the thing is built.

2. What we cannot see

  • Anything inside your vault: every login, note, card and identity — including what you called them.
  • Your Master Password and your Secret Phrase.
  • The keys that would open any of the above.

3. What we do hold

Running an account for you needs a small amount of information. This is the complete list.

  • Your email address — the only thing stored in the clear, because we need it to sign you in and to send you account and security emails.
  • Your display name — stored encrypted.
  • The address and browser a session came from — recorded when you sign in, so you can recognise your own devices and spot one that is not yours; stored encrypted.
  • Two-factor codes' seed — only if you turn two-factor on; stored encrypted.
  • Your security alerts and account history — a record of security-relevant events, such as new-device sign-ins, password changes and two-factor changes; stored encrypted.
  • Counts and timestamps — how many items you keep and when they were created or changed. These show how much you store and when, never what.

That is all of it. There is no analytics, no advertising, and no third-party tracking of any kind.

4. Why we are allowed to hold it (lawful bases)

  • To provide what you signed up for — your email address, display name, two-factor seed and locked vault are held because the service cannot work without them.
  • Legitimate interest in keeping your account safe — the address and browser of each session, your account history and your security alerts exist so that unauthorised access can be spotted, by you and by us. This is narrow, security-only, and stored encrypted.

5. How long we keep it

  • Sessions — expire after 30 days, or the moment you sign out or sign that device out.
  • Items in the trash — kept for 30 days after you delete them, then destroyed.
  • Account history and security alerts — kept while your account exists, so you can look back over it.
  • Deleting your account — you can do it yourself in Settings, and it is immediate and final: your locked vault, your account details and your history are erased.

6. Your rights

Under the UK and EU GDPR you can ask to see your personal data, to have it corrected or erased, to restrict or object to how it is used, and to receive a copy of it. Two of those you can do yourself, straight away: everything in your vault is yours to edit or copy out in the app, and deleting your account is one button in Settings. For anything else, email [email protected] and we will answer within one month.

One honest caveat: where your vault is concerned, all we can act on is locked text. We can delete it; we cannot read it, correct it or disclose it — by design, nobody but you can. You are also free to complain to your data protection authority, which in the UK is the Information Commissioner's Office.

7. Who else touches your data

Two companies, each for one job:

  • Mailgun — sends our email, and only the necessary kind: address verification and security alerts. They handle your email address for that and nothing else.
  • Cloudflare Turnstile — the "confirm you're human" check on the sign-in and sign-up forms, which is what stops those two pages being hammered by scripts. It runs on those pages only, never inside your vault, and it sees your IP address and browser characteristics for the moment it takes to decide. It is not an analytics or advertising product: it does not track you across sites and sets no cookie on this one.

There is nothing else plugged in. We do not sell personal data, we do not share it for advertising, and we never will.

8. Security alerts

When something security-relevant happens on your account — a new device signing in, a password change, two-factor going on or off — we tell you, in the app and by email. You can quieten most of the emails in Settings, but the in-app alerts stay: not being told is exactly what an intruder would prefer.

9. If something goes wrong

If we suffer a breach affecting your personal data, we will tell the relevant authority within 72 hours where the law requires it, and tell you directly without undue delay — plainly, including what it means for you. Because your vault is locked text to us, a break-in on our side does not expose what is inside it. We would still tell you.

10. Changes and contact

If we change this policy in a way that matters, we will let you know by email or in the app before it takes effect. The one thing that will not change is that we cannot read your vault.

Questions, requests or concerns: [email protected].