⬡ OpaqueVault
Docs Pricing Security Blog
Get started
// Legal

Privacy Policy

Last updated: April 10, 2026

⬡
The short version: OpaqueVault is architecturally zero-knowledge. We cannot read your secret values — ever. Your secrets are encrypted on your device before they reach our servers. We store only ciphertext. This policy explains what we do collect, why, and how you can control it.

1. Who we are

OpaqueVault is operated by OpaqueVault, Inc., a company incorporated in the State of Arizona, United States. References to "OpaqueVault," "we," "us," or "our" in this policy refer to OpaqueVault, Inc.

Contact: [email protected]

2. What we collect and why

Account information

When you create an account, we collect your email address. We use it to authenticate you, send transactional emails (account confirmation, password reset), and communicate service updates. We do not sell your email address or use it for advertising.

Argon2id salt

We store a randomly generated 16-byte salt associated with your account. This salt is used by your device to derive your Key Encryption Key (KEK) from your master password via Argon2id. The salt is not secret — it is returned when you authenticate — but it is unique per user and necessary for key derivation. We cannot derive your KEK from it.

Encrypted secret blobs

We store the encrypted output of your secrets: ciphertext_b64, nonce_b64, dek_encrypted_b64, and dek_nonce_b64. These are the only forms in which your secrets exist on our servers. We cannot decrypt them. We do not have your master password, your KEK, or any Data Encryption Key in plaintext. A subpoena to OpaqueVault cannot produce your plaintext secret values because we do not have them.

We also store secret names in plaintext for MVP. We plan to encrypt secret names in a future release.

API keys

We store a BLAKE3 hash of each API key you create, a display prefix (the first 8 characters), a name, scope, and creation/revocation timestamps. The plaintext API key is shown to you exactly once at creation and is never stored by us.

Audit log

We log every secret operation (read, write, delete, list) and MCP interceptor event. Log entries include: operation type, HMAC-SHA256 hash of the secret ID (not the name or value), the API key ID used, IP address, user agent, and timestamp. Secret names and values never appear in log entries.

Usage and technical data

We collect standard server logs including:

  • IP addresses and approximate geolocation (country/region)
  • HTTP request metadata (method, path, status code, response time)
  • User agent strings
  • Error reports (stack traces, without secret values)

We use this data to operate, secure, and improve the service. We retain server logs for 90 days.

Payment information

Payment processing is handled by Stripe. We do not store credit card numbers or payment card data on our servers. We store your Stripe customer ID and subscription status. Stripe's privacy policy governs how Stripe handles your payment data.

What we do not collect

  • Plaintext secret values — ever
  • Your master password — ever
  • Your Key Encryption Key (KEK) — ever
  • Browser fingerprints or cross-site tracking identifiers
  • Data from third-party advertising networks

3. How we use your data

We use the data we collect to:

  • Provide, operate, and maintain the OpaqueVault service
  • Authenticate you and authorize API requests
  • Send transactional emails (account confirmation, password reset, billing receipts)
  • Detect and prevent abuse, fraud, and security incidents
  • Comply with legal obligations
  • Improve the service based on aggregate, anonymized usage patterns

We do not use your data for behavioral advertising. We do not sell your data to third parties. We do not use your data to train machine learning models.

4. Data sharing

We share data only in the following circumstances:

  • Service providers: We use Stripe (payments), Fly.io (infrastructure), and Sentry (error monitoring). Each is bound by a data processing agreement. None of these providers receive your secret values (which we do not have).
  • Legal requirements: We may disclose data if required by law, court order, or government request. Because we cannot decrypt your secrets, any such disclosure would produce only ciphertext — useless without your master password.
  • Business transfers: If OpaqueVault is acquired or merged, your data may transfer to the acquiring entity. We will notify you before your data becomes subject to a materially different privacy policy.

5. Data retention and deletion

We retain your account data for as long as your account is active. When you delete your account:

  • Your account, all secrets, and API keys are scheduled for deletion immediately
  • All data is permanently deleted from our systems within 30 days
  • Audit log entries are anonymized (user ID replaced with a tombstone value) within 30 days. Aggregate, anonymized audit metrics may be retained longer for security analysis.
  • Backups containing your data are purged within 30 days of the deletion cycle

To delete your account, go to app.opaquevault.com → Settings → Delete Account, or email [email protected].

6. Security

We use industry-standard security practices including encryption in transit (TLS 1.3 with ML-KEM-768 + X25519 hybrid KEM), encryption at rest (AES-256-GCM), access controls, and audit logging. Our zero-knowledge architecture means the most sensitive data — your secret values — is never accessible to us or our infrastructure.

To report a security vulnerability, email [email protected]. See our Security page for our full disclosure policy.

7. California privacy rights (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information we collect and how we use it
  • Request deletion of your personal information
  • Opt out of the sale of your personal information (we do not sell personal information)
  • Non-discrimination for exercising your privacy rights

To exercise these rights, email [email protected]. We will respond within 45 days.

8. Children's privacy

OpaqueVault is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us at [email protected].

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email and by posting a notice on the site at least 30 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

10. Contact

Questions about this policy: [email protected]
OpaqueVault, Inc. · Arizona, United States

⬡ OpaqueVault Zero-knowledge · Quantum-safe · MCP-native
Docs Pricing Security Privacy Terms
Created by The Hunter Foundry