Kearsarge Vault Privacy Policy

1. The short version

• Your vault is encrypted on your device before it is saved or sent anywhere. The only readable copies are ones you choose to make: a value you copy to the clipboard, an unencrypted export, or a plain-text share shown as a QR code.
• We never receive your vault, your master password, your recovery codes or your secrets.
• There is no Kearsarge Vault server, no user account, no analytics, no crash reporting, no advertising and no cookies.
• If you turn on Google Drive backup, the encrypted vault goes to your own Google Drive. We cannot read it, and neither can Google.
• The app contacts GitHub, Vercel or Have I Been Pwned only when you set up or use those features.
• The Android app contacts Google Play's billing service only when you open Plan or an upgrade prompt, restore purchases or redeem a code, and, once you own a plan, each time you open or return to the app. Google Play handles any payment: we never receive your payment details, and the vault records only the plan and Google Play's order number.

2. What stays on your device

The app stores your vault in your browser's or device's local storage (IndexedDB). What it stores there is the encrypted vault file, a few recent encrypted copies for undo, and settings for this device.

Your vault is encrypted with AES-256-GCM, using a key derived from your master password with Argon2id. Decrypted items exist only in the app's memory while the vault is unlocked. Locking the vault clears them.

A few small things are stored on the device without that encryption, because the app needs them before you unlock:

• Vault names. Each device keeps the name of each vault on it, so the lock screen can show which vault you are opening. Vault names are never sent to Google Drive or anywhere else in readable form.
• Failed unlock attempts. For each vault on the device, the number of wrong master passwords or recovery codes typed on this device and the time of the last one, so the lock screen can make you wait before the next try. It is never sent anywhere, and it resets when you unlock.
• The Google account you connected, so the app can show "Connected as …" and keep syncing with the same account.
• Sync and app settings, such as the theme, the last vault you opened, when the vault last synced, and which vault items hold your GitHub and Vercel tokens (the item, not the token).
• Which entries this device changed: each entry's id, when it was changed and a fingerprint of its encrypted form, and the names (never the values) of vault settings changed here. When the vault's key is changed on another device, only this device's own changes move over to the new key.
• A list of changes to review, after such a key change: which entries of this device's old copy weren't brought over and how they differ (edited, deleted, or the names of settings). The entries themselves stay encrypted; their titles are shown only while the vault is unlocked. The list is deleted when you dismiss it.

None of this leaves your device.

Files you save. Files the app saves go where you choose. We never receive them.

• An encrypted export (a .kvault file) is encrypted in the same way as your vault.
• The Recovery Sheet (an .html file you can print) shows your recovery codes in readable form. Anyone who has it and a copy of your vault can open the vault.
• An unencrypted export (CSV, JSON or .env) can be read by anyone who can open it. The app warns you before it saves one.
• A share file holds an encrypted share (see "Sharing items" in section 4). Its file name and the short note at the top name nothing inside the share.
• A calendar reminder (an .ics file) holds the event's title, date and description, as described under "Google Calendar reminders" in section 4.

3. Google Drive

Google Drive backup is optional. The app works without it. Google is used only as a place to store your encrypted vault. Connecting Google does not sign you in to Kearsarge Vault and does not create an account with us.

What the app asks Google for. When you connect Google Drive, the app requests exactly two permissions:

• https://www.googleapis.com/auth/drive.appdata: a hidden app folder in your Drive that only Kearsarge Vault can see.
• https://www.googleapis.com/auth/drive.file: access to files and folders that Kearsarge Vault itself creates. It cannot see, open or change any other file in your Drive.

The app does not request access to your whole Drive, your contacts, your profile or your Gmail.

What the app stores in your Drive.

• In the hidden app folder: one encrypted vault file per vault, kept in sync between your devices.
• In a visible folder named "Kearsarge Vault Backups": dated encrypted copies of your vault (up to 30 daily and 12 monthly copies per vault), a README, and a small program that can decrypt a backup offline with your master password or a recovery code. When the app upgraded a vault to its current file format, it also keeps the encrypted copy from before the upgrade there, and deletes it 14 days later, or sooner if you change your password or ask it to.
• When you change your vault's key (for example by turning on "Require a passkey"), you can ask the app to delete the copies saved under the old key: the dated copies, the copy from before the upgrade, and the earlier versions Google keeps of the hidden file.

Everything the app stores in Drive about your vault is encrypted on your device first. Each file is labeled with a random vault ID so the app can find it. Your vault's name and contents are inside the encryption.

Your Google account email address. The app reads the email address of the connected Google account from Google Drive, so it can show which account is connected and avoid syncing with the wrong one. It is stored only on your device.

Where this data goes. The app talks to Google directly from your device. The data does not pass through any server of ours. On the web, Google returns a short-lived access token to the app's own page at the end of sign-in. The app keeps that token in memory only.

Limited Use. Kearsarge Vault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means we use Google Drive access only to back up and sync your encrypted vault, which are features you can see and control in Settings. We do not transfer data from Google to anyone, use it for advertising, have people read it, or use it to train AI or machine learning models.

4. Other services the app contacts

Apart from Google's own sign-in screen, the app connects only to the services below. The app's own code is built so that it cannot reach any other address. The one exception is Google Play's billing library in the Android app: Google provides it, and it talks to Google Play and Google's services as described in the Google Play billing row. Each of these services sees your device's IP address and normal request details, as any website does, and handles them under its own privacy policy.

The Vercel change check. If you have a Vercel token set up, the app also checks, while your vault is unlocked and at most every 10 minutes, whether variables you pushed have changed in Vercel. This check reads variable names and timestamps only, never values, and keeps the result in memory.

GitHub and Vercel tokens are stored as items inside your encrypted vault. They are sent only to the service that issued them. Data you send to GitHub or Vercel is stored in your own account with that service. We never receive it.

Buying Pro or Pro+ (Android). Plans are bought through Google Play. Google processes the payment under its own privacy policy, and we never receive your payment details. A Free user who never opens Plan or an upgrade prompt never contacts Google Play. Redeem a code opens Google Play's own redeem screen.

The vault records the plan you bought, its purchase date and Google Play's order number, encrypted like everything else in it, so the same vault gets the plan in the web app and on your other devices. It never records a payment detail or a purchase token. As for every app, Google Play gives us, as the app's developer, the order details it shows in its Play Console. We use them only to handle purchases and refunds and to keep our accounting records.

Links you open. Some buttons and links open another website in your browser. Examples are a provider's dashboard in a rotation guide and a website saved on a login. This is ordinary navigation that you start. The app does not make the request, and the site you open sees what any website sees.

Google Calendar reminders. If you choose Open in Google Calendar for a secret's expiry, Google Calendar opens in your browser (or, on some phones, in the Google Calendar app) with an event filled in: a title, the date and a one-line description. By default the title is "Credential renewal due" and nothing in the event names anything in your vault. If you turn on Name the secret in the event, the title and description include the secret's name and its app's name. They never include its value. Google receives these details when its page opens, whether or not you save the event, and handles them under Google's privacy policy. Kearsarge Vault sends nothing to Google itself. This does not use your Google Drive connection, and the app has no access to your calendar. Download .ics saves the same event as a file on your device instead.

Sharing items. You can share items with another person as QR codes, a link or a file.

• A protected share is encrypted on your device with a share code that the app creates. The code is never part of the QR codes, the link or the file. You give it to the other person yourself, another way.
• A plain-text share is not encrypted. It is shown only as a single QR code on your screen, and anyone who can see the code can read it. It is never put in a link or a file.
• A share link is an address on vault.kearsargestudios.com with the encrypted share after the "#". Browsers do not send the part after "#" to the website, so our hosting provider never receives the share. Its logs record only that the share page was opened (see section 6). When the link opens, the app removes the share from the address bar. Your browser's history may still keep the full link, and may sync it under your browser's settings. The link still contains the encrypted share, and the email or chat service you send it with keeps it like any other message. Anyone with the link and the code can open it. Neither expires.
• Share text you copy goes wherever you paste it. The email or chat service you send it with keeps it like any other message.
• We run no server for shares, so a link or file cannot be revoked and does not expire. Anyone who has both the share and its code can open it. If you shared something by mistake, rotate the secret or change the password.

5. Android permissions and features

The Android app requests these permissions:

• Internet, to reach the services in section 4.
• Camera, only when you scan a QR code in the app (for example, to receive a shared item). Android asks you the first time. Images are decoded on your device and are not saved or sent anywhere. The app does not use any Google or third-party scanning service.
• Biometrics, for optional fingerprint or face unlock. This uses your device's secure hardware (Android Keystore). The app only learns whether unlock succeeded. It never receives your fingerprint or face data.
• Notifications, for reminders about secrets that are about to expire. Reminders are scheduled on your device. No push service is involved.
• Google Play billing, to buy Pro or Pro+ through Google Play.
• Network state, which Google Play's billing library uses to check for a connection before it sends its diagnostics.

Other features:

• Autofill. If you choose Kearsarge Vault as your autofill service, Android shows the app the type of form you are filling in and which app or website it belongs to, so the app can offer matching logins. This happens on your device. To fill outside the app, Kearsarge Vault keeps an encrypted copy of the vault in its private storage. It is not included in device backups, and it is deleted when you turn autofill off or turn off biometric unlock.
• Passkey unlock. If you set up a passkey to unlock the vault, your passkey provider (for example, Google Password Manager) stores the passkey under its own policy. We do not receive it.
• Screenshot blocking. By default the app blocks screenshots and screen recording of its screens. You can change this in Settings.
• Sharing text to the app. Text you share or select into Kearsarge Vault from another app stays on your device.

The Android app contains the whole app. It does not load it from our website.

6. The website

The web version of Kearsarge Vault is served from vault.kearsargestudios.com by our hosting provider, Vercel. Vercel keeps standard server logs, which include your IP address, browser type (user agent), the page requested and the time. We use these logs only to run and secure the site. They never contain your vault data. Vercel keeps them for a limited time under its own policies.

The website sets no cookies and runs no analytics or advertising scripts. Every script, font and style is served from our own site.

7. If you email us

If you email us, we receive your email address and whatever you choose to send. We use it only to reply to you.

Never send us your master password, recovery codes or secrets. We will never ask for them, and we cannot use them to help you: we have no copy of your vault.

8. What we never do

• We do not sell or rent personal information.
• We do not show ads or share data with advertisers.
• We do not use your data, including any data from Google, to train AI or machine learning models.
• We do not track you across apps or websites.

9. Deleting your data

Your data is on your devices and, if you connected it, in your own Google Drive. You control both.

On a device. In the app, go to Settings → Danger zone → Remove vault from this device. This deletes that vault's encrypted file, its local backups, its settings and its autofill copy from that device. On Android, uninstalling the app also removes its local data. In a browser, clearing the site's data for vault.kearsargestudios.com removes everything the app stored. Removing a vault from a device does not delete it from Google Drive or other devices.

In Google Drive. Disconnecting Drive in Settings → Backup & sync stops that device from syncing. It does not delete files already in Drive. To delete them:

• Delete the "Kearsarge Vault Backups" folder from your Drive, then empty your Drive trash.
• Delete the hidden sync files: in Google Drive on the web, open Settings → Manage apps, find Kearsarge Vault, and choose Delete hidden app data.

Revoke Google access. To remove Kearsarge Vault's access to your Google account, go to myaccount.google.com/permissions and remove Kearsarge Vault.

GitHub and Vercel. Values you pushed stay in your GitHub or Vercel account until you delete them there. You can revoke the tokens you created on those sites at any time.

Calendar events and shares. Events you added to Google Calendar stay there until you delete them in Google Calendar. A share link or file you sent cannot be recalled: delete the message or file, and rotate anything you shared by mistake.

Deletion cannot be undone. We have no copy and cannot restore a vault for you.

Website logs and email. To ask about server logs or email you sent us, contact us at the address below.

10. Security

The app uses standard, published cryptography: AES-256-GCM encryption and Argon2id key derivation. The vault file format is documented, and offline tools can open an exported vault without the app. The website and app load no code from other sites.

No system is perfectly secure. Your vault is only as strong as your master password and the security of your devices. If you forget your master password and lose your recovery codes, no one, including us, can recover your vault.

To report a security problem, email us at the address below.

11. Children

Kearsarge Vault is not directed to children under 13, or the minimum age in your country. We do not knowingly collect personal information from children.

12. Your rights

Depending on where you live, for example under the EU or UK GDPR or California law, you may have rights to access, correct or delete personal information about you. We hold no vault data, no account and no data from your Google Drive. The only personal information we could hold is email you sent us, the website logs described in section 6, and, if you buy a plan, the order details Google Play gives us (section 4). To make a request, contact us. You may also complain to your local data protection authority.

13. Changes to this policy

If we change this policy, we will post the new version on this page with a new effective date. If a change affects what the app sends off your device, we will also tell you in the app before it takes effect. New features that send nothing until you use them are explained on the screen where you use them and in this policy.

14. Contact

Kearsarge Studios LLC
Email: privacy@kearsargestudios.com

This policy is also published by the app at vault.kearsargestudios.com/privacy.