Terms of Service

These terms govern your use of Vault, a password manager produced by Deepak Marathe, sole proprietor, India. By installing, using or purchasing, you agree to them.

Purchases are sold by our merchant of record, who is the seller of record for the transaction, issues your invoice, and handles payment and applicable taxes. Your purchase contract for the payment itself is with them; the licence is granted by us.

Read this first

What you are buying

Vault is a local-first, zero-knowledge password manager for iPhone, iPad, macOS, Windows, Android, Chrome, the web and the command line. The Free tier is unlimited in items, passkeys and TOTP codes and is not time-limited. Premium adds unlimited synced devices, continuous breach monitoring, unlimited collections and managed sharing, and larger attachment limits. Family is Premium for 6 people, each with their own separate vault.

Licence

We grant you a personal, non-exclusive, non-transferable, revocable licence to install and use Vault on devices you own or control. You may not resell, sublicense or redistribute licence keys, remove proprietary notices, or use our product name for a derivative distribution without written permission. Where Vault source code is published under an open-source licence, that licence governs the source code and takes precedence over this section to the extent of any conflict.

Reverse engineering is prohibited except where that restriction is unenforceable under applicable law, including EU interoperability provisions. Store terms (Apple, Google Play, Microsoft Store, Chrome Web Store) apply in addition where you obtained Vault there; for Apple-distributed versions Apple is a third-party beneficiary of these terms and has no obligation to furnish support.

Your data and your infrastructure

We never hold anything we can read. That is a narrower claim than "no server", and it is the accurate one. Where you sync, your encrypted vault is stored either in your own Google Drive under your Google account and Google's terms, or — if you sign in to a Vault account — as a ciphertext row in our Supabase database, alongside your vault key wrapped under your master password. Neither can be opened without that password, which we never receive: the value sent to authenticate you is a separately derived hash, not the password and not the key. Where you use cross-user sharing, a lightweight identity publishes your public key. You are responsible for your master password, your devices and their security, your Google account, and your backups.

Subscriptions, renewal and delivery

Delivery is immediate and electronic; there is no physical product and no shipping. Monthly and annual subscriptions renew automatically until cancelled. Cancel at any time through the link in your receipt or by emailing us; access continues to the end of the paid period. Prices may change for future renewal periods with at least 30 days' notice. Where you subscribed through an app store, cancellation and refunds follow that store's own terms.

A lapsed subscription never locks your vault. Your items stay readable, writable and exportable on the Free tier. Limits change; access to your own data does not.

Acceptable use

Summarised here and set out in full in our Acceptable Use Policy: do not use Vault unlawfully, to hold credentials you are not authorised to hold, to attack or overload the notification relay or sharing directory, or in breach of export control and sanctions law. We cannot see your vault contents and therefore do not and cannot monitor them; enforcement is limited to the optional service components we control.

Availability

Vault's core function is local and works offline. The optional relay and sharing directory are provided as is, with no uptime commitment, and may be modified or discontinued with notice where practicable. Discontinuing them does not destroy your vault: it remains on your device and in your Drive, and export remains available.

Warranty and liability

Vault is provided "as is" and "as available", without warranty of any kind to the maximum extent permitted by law. We do not warrant that it will be uninterrupted or error-free, that its cryptography is free of implementation flaws, that the underlying primitives will remain unbroken against future cryptanalysis or quantum computation, or that data held by third parties (Google Drive, Supabase) will remain intact. No independent third-party security audit has been performed. Vault does not protect against a compromised operating system, malware or a keylogger on your device, someone with physical access to an unlocked session, a coerced disclosure of your master password, or a phishing site you personally type credentials into.

To the maximum extent permitted by law we are not liable for indirect, incidental, special, consequential or punitive damages, or for loss of or inability to access data, credentials or accounts. Our total aggregate liability will not exceed the amount you paid us in the twelve months preceding the claim. We are specifically not liable for data loss resulting from a forgotten master password, lost recovery material, loss of all devices, or deletion of your Drive file — those are inherent to a zero-knowledge design, not defects.

Some jurisdictions do not allow these exclusions. Nothing here excludes liability that cannot lawfully be excluded, and EEA and UK consumers keep their non-excludable statutory rights.

Export controls

Vault contains cryptographic functionality and is subject to export control and sanctions law. You confirm you are not located in a comprehensively sanctioned territory, are not on a restricted-party list, and will not use Vault for a prohibited end use. Some jurisdictions restrict the import or use of encryption software; compliance where you use it is your responsibility.

Termination

You may stop using Vault at any time. We may suspend access to the optional relay and sharing directory, or terminate the licence, for material breach. Termination does not delete your data — it is on your device and in your Drive — and does not enable us to access it.

Governing law

These terms are governed by the laws of India, and the courts of Mysuru, Karnataka, India have jurisdiction, without depriving consumers resident in the EEA or UK of mandatory local consumer protection or the right to bring proceedings in their local courts.

Changes and contact

We may update these terms and will post the updated version here with a new date; material changes take effect 30 days after posting. founder@dfacto.ai · Deepak Marathe (sole proprietor), Mysuru, Karnataka, India. Full business address available on request and held on file by our merchant of record.