Privacy Policy

Last updated: 29 August 2026

1. Introduction

VaultHarbor (“we”, “us”) is a zero-knowledge password manager operated by Manoj Hankare. This Privacy Policy explains what information we collect, how we use it, and your rights when you use VaultHarbor at https://vaultharbor.manojhankare.in and the VaultHarbor browser extension.

VaultHarbor is built on a zero-knowledge architecture: your master password and decrypted vault contents never leave your device. We cannot read your stored credentials.

2. Information we collect

When you create an account and use VaultHarbor, we may store:

• Account information: email address and a one-way hash of your account password (Argon2id). We never store your account password in plaintext.
• Encrypted vault data: your vault as an opaque, encrypted blob and wrapped encryption keys. We cannot decrypt this data.
• Key derivation metadata: salts and KDF parameters required for client-side key derivation. These do not reveal your master password.
• Device information: device name, type (e.g. browser), and an opaque device identifier for sync and session management.
• Sync metadata: vault revision numbers, sync timestamps, and event records. These contain no plaintext credentials.
• Authentication tokens: hashed refresh tokens for secure session management.
• Password reset tokens: hashed, time-limited codes when you request an account password reset.
• Server logs: request metadata (timestamps, HTTP method, path, status code, request ID) for reliability and security. We do not log master passwords, vault plaintext, authorization headers, or raw tokens.

3. Information we do not collect

VaultHarbor is designed so that we never receive or store:

• Your master password
• Your recovery key in plaintext
• Individual usernames, passwords, or notes from inside your vault
• Decrypted vault contents at any time

4. How we use your information

We use collected information solely to:

• Authenticate your account and maintain secure sessions
• Store and sync your encrypted vault across your devices
• Send account password reset emails when you request them
• Operate, secure, and improve the VaultHarbor service
• Respond to support requests and legal obligations

We do not sell your personal information. We do not use your vault data for advertising or profiling.

5. Zero-knowledge encryption

All vault encryption and decryption happens on your device. Data is encrypted with AES-GCM before upload. The server treats your vault as an opaque binary blob and cannot access individual credential fields inside it.

6. Third-party services

VaultHarbor relies on the following infrastructure providers:

• Vercel: hosts the VaultHarbor API
• Supabase (PostgreSQL): stores account and encrypted vault data
• Brevo: sends transactional emails (e.g. password reset codes)

These providers process data on our behalf under their own privacy policies and contractual safeguards. Encrypted vault blobs remain unreadable to us and to these providers without your master password.

7. Data retention and deletion

We retain your account and encrypted vault data for as long as your account is active. You may delete your vault from within the extension. To request full account deletion, contact us at manojhankare2@gmail.com. We will delete your account records and encrypted vault data from our servers within a reasonable period.

8. Cookies and tracking

The VaultHarbor marketing website does not use analytics cookies or third-party advertising trackers. The browser extension stores session tokens and cached vault data locally in your browser, not in cross-site tracking cookies.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you (email, account metadata)
• Request correction of inaccurate account information
• Request deletion of your account and associated data
• Export your encrypted vault (via the extension) before deletion

To exercise these rights, contact manojhankare2@gmail.com. Because we cannot decrypt your vault, we cannot provide plaintext credential exports; only the encrypted blob stored on our servers.

10. Security

We use industry-standard measures including HTTPS/TLS, Argon2id password hashing, hashed refresh tokens, rate limiting, and strict logging policies that exclude secrets. No system is perfectly secure; you are responsible for choosing a strong master password and storing your recovery key safely.

11. Children

VaultHarbor is not intended for users under 16. We do not knowingly collect information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect changes. Continued use of VaultHarbor after changes constitutes acceptance of the updated policy.

13. Contact

Manoj Hankare
Email: manojhankare2@gmail.com (VaultHarbor support)