Privacy Policy

Draft — review before launch
Last updated: pending legal review
[VERIFY] Encrypted database backup rotation window — exact purge period pending confirmation

The short summaries below each section are for convenience only. If there is any conflict between a summary and the full clause, the full clause governs.

1. Who we are

Little Vaulty is operated by the company below, which is the data controller for the personal data described in this policy.

Little Vaulty is operated by the company named below. That company is the data controller for the personal data described in this policy — meaning we decide why and how it is processed.

2. The zero-knowledge principle (read this first)

Your vault is encrypted on your device before it syncs; we cannot read vault contents. We still process some personal data at the account layer — see section 4.

Little Vaulty is a zero-knowledge, end-to-end encrypted password manager. Your vault contents are encrypted on your device before they reach our servers. We store only ciphertext: scrambled data we cannot read.

We never receive, store, or have access to your master password or vault encryption key. Because of that, we cannot read, recover, decrypt, or hand over your vault contents — not to you if you forget your master password, and not to anyone else who asks us to.

Zero-knowledge applies to your vault. It does not mean we process no personal data at all. We do process account and service data in plaintext, as described in section 4.

3. What we process — vault data (zero-knowledge)

The following is encrypted on your device and stored only as ciphertext we cannot read.

The following data is encrypted on your device before it is sent to us. We store only ciphertext and cannot read it:

• Vault item contents — title, URL, username, password, and notes (stored together in one AES-256-GCM blob per item)
• Password history
• Secure-note title and body
• Tags
• Profile names

Encryption uses Argon2id key derivation (64 MiB memory, 3 iterations, parallelism 1) and AES-256-GCM with a fresh random IV per item. The vault key is derived in your browser and is never transmitted to us.

4. What we process — account & service data (plaintext)

We also process personal data at the account layer that we can see and must protect under UK GDPR.

Separately from your encrypted vault, we process the following personal data in plaintext (or in a form we can access) to run the service:

• Username and email address — account identity, authentication, and service communications
• Recovery email — optional contact address on file (not used to decrypt your vault)
• TOTP two-factor secret — encrypted at rest on our servers, but not zero-knowledge: we hold the server-side key needed to verify your authenticator codes at sign-in
• Tier and subscription status — which plan you are on and whether it is active
• Session data — active sessions and related metadata needed to keep you signed in securely
• Security audit-event metadata — event type and timestamp only (not vault content)
• IP address and access logs — network and security logging
• Timestamps — creation, update, and activity times associated with your account and service use

We do not use analytics, advertising, or third-party tracking. There is no Google Analytics, Plausible, PostHog, Sentry, or advertising pixels in the product. We use essential cookies only (see our Cookie Policy).

5. Lawful bases (Art. 6 UK GDPR)

We rely on contract, legitimate interests, and legal obligation — not consent for analytics or marketing.

We process personal data on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — to create and run your account, sync your encrypted vault, provide features you subscribe to, and communicate about the service
• Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent abuse and fraud, maintain audit trails, and protect users and our systems (balanced against your rights)
• Legal obligation (Art. 6(1)(c)) — where we must retain billing and subscription records (for example, UK tax and accounting rules)

We do not rely on consent for analytics or marketing because we do not run analytics or marketing tracking.

6. Payment processing

Paddle is our Merchant of Record; we do not store card details.

Paid plans are processed by Paddle.com, which acts as our Merchant of Record and reseller. Paddle is the seller of record for your purchase and processes payment card data as a separate controller for that purpose.

We do not store your card details. We receive subscription status and billing metadata needed to provide your plan. For how Paddle handles payment data, see Paddle's privacy policy.

7. Sub-processors and retention

We use Vercel, Supabase, Paddle, and Resend. Retention periods are set out below.

We use the following sub-processors. Each processes data only as needed for their role:

• Vercel — hosting, edge, and CDN. Processes IP address and request metadata (not vault data). US-based (edge global). Safeguard: Standard Contractual Clauses (SCCs) + UK Addendum.
• Supabase — database and storage. Ciphertext and account-layer data. EU/Ireland (adequate).
• Paddle — Merchant of Record and payments. Payment and billing identifiers; Paddle holds payment card data as its own controller — we do not store card details. Global. Safeguard: SCCs + UK Addendum.
• Resend — transactional email. Email addresses and message content for transactional emails (for example, recovery-email verification and security notifications). US. Safeguard: SCCs + UK Addendum.

We retain data for the following periods:

When you delete your account, we cascade hard-delete your ciphertext and account data from our live systems. Deleted data may persist in encrypted database backups only until purged from encrypted backups within our backup-rotation window [VERIFY: backup window].

8. International transfers

Primary hosting is in the EU (Ireland); some sub-processors may process data outside the UK.

Little Vaulty's database is hosted in the EU (Ireland), which benefits from a UK adequacy decision. Some sub-processors (Vercel, Paddle, Resend) may process limited data outside the UK/EEA. Where they do, the transfer is protected by appropriate safeguards — the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. [VERIFY: confirm each sub-processor's Data Processing Agreement is accepted and on file before launch.]

9. Your rights (UK GDPR Arts. 15–22)

You have standard UK GDPR rights; contact privacy@littlevaulty.com. We cannot provide readable vault contents in a DSAR.

If you are in the UK or EEA, you have rights over your personal data, including:

• Access — ask for a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (subject to legal exceptions)
• Portability — receive your data in a structured, machine-readable format where applicable
• Objection — object to processing based on legitimate interest
• Restriction — ask us to restrict processing in certain circumstances

To exercise any of these rights, email privacy@littlevaulty.com. We will respond within the timeframes required by law.

Zero-knowledge limitation: we can provide account-layer data and delete everything we hold, but we cannot hand over readable vault contents in a data-subject request — no decryption key exists on our side. You can export your own vault using your export password in the app.

You may delete your account at any time from your settings. Deletion removes your account rows and encrypted vault data from our live systems, as described in section 7.

10. The recovery limitation

If you lose your master password, your vault is permanently inaccessible — we cannot recover it.

If you lose or forget your master password, your vault is permanently and irrecoverably inaccessible. We cannot recover, reset, or bypass it. This is consistent with our zero-knowledge design, not a gap in our systems.

If you cannot unlock your vault but wish to close the account, you may contact support to request an operator “burn” — permanently destroying the old vault so your email can be used to register afresh. The old vault is never recovered or decrypted.

11. Security measures (Art. 32)

We use industry-standard encryption and access controls; residual risk remains on a compromised, unlocked device.

We implement appropriate technical and organisational measures, including:

• On-device encryption before sync (Argon2id + AES-256-GCM)
• Two-factor authentication (TOTP)
• Account lockout after failed attempts
• Configurable session timeout
• Encrypted storage of vault ciphertext at rest on our infrastructure

No system is risk-free. If your device is compromised while your vault session is unlocked, an attacker with access to that device may be able to read your vault — that risk is outside what we can protect once the vault is open on your machine.

12. Breach notification

We will notify the ICO and affected users where UK GDPR requires it.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office within 72 hours where required under UK GDPR Article 33, and we will notify affected users without undue delay where the breach is likely to result in a high risk to you under Article 34.

13. Complaints

You may complain to the ICO if you are unhappy with how we handle your data.

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your personal data lawfully. You can find guidance and make a complaint at ico.org.uk/make-a-complaint.

14. Changes & contact

We may update this policy; contact privacy@littlevaulty.com with questions.

We may update this policy as Little Vaulty evolves. Material changes will be communicated through the service or by email where appropriate. The “Last updated” line at the top of this page will be revised when changes take effect.

Questions about this policy or your personal data? Email privacy@littlevaulty.com.

See also our Cookie Policy and Refund & Cancellation Policy.