Privacy policy

In one sentence

Vaultyn does not collect, upload or sell any of your personal data. There is no account system, no server holding your data, and no analytics or ads.

Where your data lives

Everything you record in Vaultyn is encrypted with AES-256-GCM (the key is derived from your master password with Argon2id) and stored on your Mac and in a folder you choose (for example iCloud Drive).

We cannot access this data and cannot recover your master password.

Features that use the network

These features connect only when you use them, and all are optional:

Website icons (off by default): when on, the app visits the entry’s website to read its icon, or asks icon.horse / favicone.com, sending that website’s domain.

App Store icons: for app entries, sends the app’s ID to Apple’s public lookup service.

Password breach check: sends only the first 5 characters of the password’s SHA-1 hash to Have I Been Pwned (api.pwnedpasswords.com); matching happens on your device and the password never leaves it.

Breached sites and two-factor support lists: public lists are downloaded from haveibeenpwned.com and 2fa.directory and compared on your device; none of your data is sent.

Exchange rates (assets feature, off by default): fetched from open.er-api.com, sending only your base currency code.

These services are run by third parties, can see your IP address, and have their own privacy policies.

Data sources: the breached-sites list comes from Have I Been Pwned (CC BY 4.0); the two-factor support list is sourced from 2FA Directory by 2factorauth (MIT).

App Store purchases

Purchases and payments are handled by Apple. We only see anonymous sales figures from Apple — never your name, email or payment details.

This website

This site is hosted on GitHub Pages and uses no cookies or analytics. GitHub may log visitors’ IP addresses for security purposes; see GitHub’s privacy statement.

Contact

Questions about this policy? Email support@vaultyn.com. Any changes will be posted on this page.