Terms of Service

Draft — review before launch
Last updated: pending legal review
Section 12 (limitation of liability) — priority item for solicitor review

The short summaries below each section are for convenience only. If there is any conflict between a summary and the full clause, the full clause governs.

1. Agreement and who we are

By using Little Vaulty, you agree to these Terms with the company named below.

These Terms of Service (“Terms”) form a binding contract between you and the company identified below (“we”, “us”, “our”). By creating an account, signing in, or otherwise using Little Vaulty, you confirm that you accept these Terms. If you do not agree, do not use the service.

2. The service

Little Vaulty is a zero-knowledge password manager that encrypts your data on your device before syncing it.

Little Vaulty is a zero-knowledge, end-to-end encrypted password manager. It lets you store credentials, secure notes, and other vault items; sync them across your devices; protect your account with two-factor authentication; import data from other managers; and (on eligible plans) export an encrypted backup of your vault. The service is designed so that your vault contents are encrypted on your device before they reach our servers.

3. The zero-knowledge model and your master password

We never see your master password or vault key. If you lose your master password, your vault is gone forever — and we cannot recover it.

This is the most important thing to understand about Little Vaulty.

Your master password and vault encryption key are created and used entirely on your device. They never leave your browser. We never receive them, never store them, and have no technical means to recover, reset, or bypass them.

If you lose or forget your master password, your vault is permanently and irrecoverably lost. We cannot help you get it back — not through support, not through an operator, not through any back door. This is the design of a genuine zero-knowledge system, not a fault or omission on our part.

You are solely responsible for remembering your master password, keeping your two-factor backup codes safe, and maintaining any export backups you choose to create. We strongly recommend you store backup codes and export files in a secure place separate from your daily device.

4. Your security responsibilities

Vault security depends on your master password, your devices, and the security features you use.

The security of your vault depends on the strength and secrecy of your master password and the security of your devices. You are responsible for choosing a strong master password and keeping it confidential.

We are not responsible for unauthorised access resulting from: a weak master password; malware, keyloggers, or other compromise of your device; you disclosing your credentials to third parties; or failure to enable available security features (for example, two-factor authentication).

Encryption protects your data at rest and in transit. It cannot protect against an attacker who has access to an unlocked session on a compromised device.

5. Accounts and eligibility

One person per account. You must be 16 or older. The service is not for children under 16.

You must provide accurate information when registering. Each account is for one individual — do not share your login credentials with others or allow anyone else to use your account.

You must be 16 or older to create an account and use Little Vaulty. The service is not directed at, and must not be used by, children under 16. By registering, you confirm that you meet this age requirement.

6. Acceptable use

Use Little Vaulty lawfully and responsibly. Our Acceptable Use Policy has the details.

You must use Little Vaulty in compliance with applicable law and these Terms. Our separate Acceptable Use Policy sets out prohibited conduct. Breaching it may result in suspension or termination of your account.

7. Plans, billing and payments

Taster is free with limits; Premium is £10/year. Billing is handled by Paddle as our Merchant of Record. See our Refund & Cancellation Policy.

Little Vaulty offers different plan tiers:

Taster Pack (£0) — free, with caps (currently 20 vault entries, 3 secure notes, and 2 trusted devices). Full import is available; full encrypted export is not included on this tier.

Premium (£10/year) — available now. Unlimited entries and notes, encrypted export, and item history.

We may introduce additional plans in future.

Paid plans are billed annually. Billing is handled by Paddle (paddle.com) as our Merchant of Record and seller of record, who collects payment and handles applicable taxes (including VAT/GST). Subscriptions renew annually until cancelled; cancelling stops auto-renewal and your plan continues until the end of the paid period, then reverts to the free Taster tier. For refund and cancellation terms, see our Refund & Cancellation Policy.

8. Your content

You own your vault data. We store only encrypted ciphertext and cannot read what you save.

You retain ownership of everything you store in your vault. Because your data is end-to-end encrypted, we cannot access, read, review, or use the contents of your vault items or notes. We store only ciphertext — encrypted blobs — to provide the sync and storage service you request.

9. Export password and data you remove from the service

Exporting your vault uses a separate export password; exported files are your responsibility.

Decrypting and exporting vault data requires a separate export password that you set — a deliberate security control distinct from your login and master password.

Once data is exported from Little Vaulty, it is outside our protection. We are not responsible for the security of exported files, nor for loss of the export password — which, like your master password, we cannot recover.

10. Availability and “as is”

We try to keep Little Vaulty running, but the service is provided without warranties and features may change.

We make reasonable efforts to keep Little Vaulty available and secure, but we do not guarantee uninterrupted or error-free operation. The service is provided “as is” and “as available”, to the fullest extent permitted by law — particularly appropriate for the free Taster tier. We may modify, suspend, or discontinue features with reasonable notice where practicable.

We recommend you keep your own encrypted export as a backup; we are not liable for loss of access during an interruption where you have not retained your own backup.

11. No warranty of absolute security

We use strong encryption and reasonable care, but no online service is risk-free.

Little Vaulty uses industry-standard encryption (Argon2id key derivation and AES-256-GCM), but no method of electronic storage or transmission is completely secure. We do not warrant that the service will be free from every possible security incident.

We commit to applying reasonable skill and care, and to notifying affected users and the ICO of a personal data breach as required by UK GDPR (within 72 hours where required).

12. Limitation of liability

Our liability is limited to the extent the law allows. Nothing here excludes rights you cannot waive as a consumer.

To the fullest extent permitted by applicable law, our total liability to you for any claim arising from or related to these Terms or your use of Little Vaulty is limited to the greater of (a) the amount you paid us in the twelve months before the claim, or (b) zero if you are on a free plan.

We are not liable for indirect, incidental, special, or consequential losses — including loss of data resulting from a forgotten master password, which is your responsibility under section 3.

Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be excluded or limited under applicable law (including statutory consumer rights under UK or EU law).

13. Suspension and termination

We can suspend or terminate for breach. You can delete your account anytime — or request a burn if you've lost your master password.

We may suspend or terminate your account if you breach these Terms or the Acceptable Use Policy, or if we reasonably believe your account poses a security or legal risk.

You may delete your account at any time from your settings. Deletion cascade-erases your account data and encrypted vault from our systems. If you have lost your master password and cannot unlock your vault, you may contact support to request an operator “burn” of the account — permanently destroying the old vault so your email can be used to register afresh. The old vault is never recovered.

14. Changes to these Terms

We may update these Terms. Material changes will be communicated; continued use means you accept them.

We may revise these Terms as Little Vaulty evolves. When we make material changes, we will notify you through the service or by email where appropriate. Your continued use after changes take effect constitutes acceptance of the updated Terms. The “Last updated” line at the top of this page will be revised accordingly.

15. Governing law and jurisdiction

These Terms are governed by the laws of England and Wales.

These Terms are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to any mandatory consumer rights you may have in your country of residence that cannot be waived by contract.

16. Contact

Questions about these Terms? Email us.

Questions about these Terms? Use the contact details in section 1.