Terms of Service and Privacy Policy

Zecure Vault is a password manager where all encryption happens on your device. Here we explain how the service works and how your personal data is handled under the General Data Protection Regulation (GDPR).

Last updated: 2026.

Quick summary

• Your passwords are encrypted in your browser before they leave your device – the server cannot read them.
• We only store your username, your email address and your encrypted vault.
• You can export all your data or delete your account entirely at any time.
• We never sell your data and do not share it with third parties for marketing.

About the service

The service lets you create, store and manage passwords and related data in an encrypted vault. Encryption and decryption happen locally in your browser using a key derived from your master password. The service is provided as is; we aim for high availability but cannot guarantee uninterrupted operation.

What data we store

The server stores your username, your email address and your vault in encrypted form. Your master password, your encryption keys and the contents of your entries never leave your device in the clear and cannot be read by the service administrators. If you lose both your master password and your recovery key, no one – including us – can recover the vault.

Legal basis (GDPR)

We process your data to provide the service you requested (performance of a contract, Art. 6(1)(b) GDPR) and to protect your account against unauthorised access (legitimate interest, Art. 6(1)(f)). Your email address is used only for security notifications and account-related messages – not for marketing without your consent.

Logs and security

Security events (sign-ins, failed attempts, changes to account settings) are logged with a timestamp and IP address and kept for 365 days in order to detect and investigate intrusions. The contents of your entries are never logged. When checking password health, only the first five characters of the password’s SHA-1 hash are sent to the Have I Been Pwned service via this server; the password itself and your IP address are never sent. The check can be turned off.

Cookies

We use only strictly necessary cookies required for the service to work: a session cookie that keeps you signed in, a cookie to protect against forged requests (CSRF), and – if you choose it – a cookie that remembers this device so you can unlock with a PIN. If the site runs behind Cloudflare, Cloudflare may also set a cookie for security and operation. All cookies are first-party except Cloudflare's, are set as HttpOnly and Secure, and contain no personal data in the clear. Because the cookies are strictly necessary for a service you actively requested, no consent is required under ePrivacy/GDPR – so we do not show a cookie banner. No tracking, analytics or marketing cookies are used, and no third-party scripts are loaded. Cookies are deleted when they expire or when you sign out; the device cookie lasts up to 400 days.

Retention period

Your data is stored for as long as you have an account. When you delete your account, all content is removed immediately and permanently from the active database. Encrypted backups are rotated out within 30 days.

Your rights

You have the right to access, rectify and erase your data, and to receive it in a machine-readable format (data portability). Under Account you can export all content, change your email address and delete your account with all content at any time. You also have the right to lodge a complaint with your data protection authority.

Your responsibility

Choose a strong master password, keep your recovery key safe, enable two-factor authentication and keep your device free of malware. The service cannot protect a vault that is unlocked on a compromised device, and you are responsible for keeping your credentials secret.

Changes to these terms

We may update these terms when needed, for example for new features or legal changes. Material changes are announced in the service. Continued use after a change means you accept the updated terms.

Questions about the processing of your personal data can be directed to the service administrator.