This is an archived version.
It was in force from 14 September 2026, and is kept so you can read the wording that applied then rather
than today's. Read the current Privacy Policy ·
All versions
Welcome to Vauz, a secure password manager offered by Sealzi. This Privacy Policy sets out what we collect, what we do with it, and what we never receive in the first place.
One point belongs at the top, because the rest of this document rests on it. Your vault stays on your own device. The Vauz application does not send it to us, does not tell us anything about it, and does not report on your use of it. What we hold is an account record, and the records a sign-in page cannot work without: which sessions you have open, so signing out can end them everywhere, and a short-lived failure counter that lets us slow down someone guessing at an account. Both are listed in full below, and neither is a log of your sign-ins. The one time we keep is when each passkey was last used, overwritten on each use and shown to you. Our website does not behave identically to the application, so the two are described separately throughout, because they are not the same thing.
2. Information We Collect
The Vauz application on your device
Nothing. The application transmits no vault contents, no entry counts, no list of the sites you saved, no usage statistics, no error or crash reports, and no check-in of any kind — not to us, and not to anyone else. Choosing a support or documentation item from its menu opens your own browser or mail client, and any request made after that belongs to that program rather than to Vauz.
Your Vauz account, if you create one
- Your name and email address.
- Public half of your passkeys: a public key, the identifier the authenticator gave it, a counter used to detect a cloned device, and whatever nickname you gave it. The private half never leaves your device and we never see it.
- For each passkey, a few technical details it reports about itself: which model of authenticator it is, if it volunteers that (we do not ask for it), how it connects — USB, NFC, Bluetooth or built in — and whether it is the kind that syncs to your other devices. That last one is why we can warn you when a passkey exists on one device only. We also record whether it was added normally or through an emailed recovery link, because a passkey added that way is restricted for a day.
- For each passkey, when you added it and when it was last used to sign in. Both are shown to you on your dashboard, because they are how you recognise a passkey that is not yours. The last-used time is a single value that is overwritten each time, not a list of your sign-ins — there is no history behind it, and it records no IP address and no browser details.
- A reference that identifies your customer record with our payment processor. We do not hold your card details.
- Which subscription you have, and the dates it runs between.
- If you join a family plan, the fact that you are a member of it.
- Your acceptance of the terms: when you ticked the box at signup, which version you accepted, and the IP address and browser you accepted from. Encrypted at rest, and read only to answer a payment dispute. Section 4 of our Terms of Service covers how long it is kept.
Our website, including the sign-in and dashboard pages
- A cookie holding a security token, set when you use the sign-in or dashboard pages. It exists to protect those pages against forged requests, not to follow you between visits.
- A cookie that keeps you signed in, and a record on our side of the sessions it belongs to, so that signing out ends them everywhere. That record holds no IP address and no browser details, and there is no log of sign-ins: we keep no list of when or from where you signed in. Session records are deleted once the sessions they describe have expired, so they do not accumulate into one. The one time we do keep is the last-used stamp on each passkey described above, which is overwritten rather than appended to.
- While someone is repeatedly failing to sign in, a short-lived counter that lets us slow them down. It is keyed by a one-way code derived from the address or identifier being tried, never by the value itself, and it is deleted once the attempts stop. Successful sign-ins are not counted or recorded.
- Our servers record web requests in the ordinary way, which includes IP addresses.
- If you send the contact form on our homepage, we receive what you typed — your name, your email address, a phone number if you gave one, and your message — together with your IP address and your browser's user-agent string. Those last two are included so that we can identify abuse of the form. The whole of it arrives as an email in our support mailbox.
- If you send feedback or a support request from the dashboard, we receive what you wrote, along with the name and email address on your account.
The Vauz browser extension
The extension sends us no vault data and no record of the pages you visit. It does load our logo image from our own server in order to draw its autofill button, and that request reaches us in the same way as any other request for a file on our site.
3. Use of Information
We use what we hold to:
- Provide and maintain our services.
- Process transactions and manage subscriptions.
- Answer you when you contact us, and act on feedback you choose to send.
- Communicate with you about your account, security notices, and support.
- Ensure compliance with our terms of service and legal obligations.
We do not build usage profiles, and we hold no analytics from which one could be built. There is no advertising on our website, and we do not sell your information.
4. Data Security
Your vault is encrypted on your own device and is readable only on that device. The encryption is built on an algorithm regarded as among the strongest in the field, with a further algorithm of our own creation applied in addition to it. We do not publish how either is put together. A detailed account of a defence tends to be worth more to the person trying to get past it than to the person relying on it.
The account information described in section 2 is transmitted only over encrypted connections. What our design protects you from, and what it deliberately does not, is set out in our threat model.
5. Sharing of Information
We do not sell your personal information, and we do not share it with third parties except as necessary to provide our services or to comply with legal obligations. This includes:
- A service provider who handles payment processing on our behalf. Signing in is not on this list: we handle it ourselves.
- Legal authorities, if required by law or to protect our rights and safety.
Your vault is not on that list, and cannot be. We never receive it, so there is nothing for us to produce — including in response to a legal demand.
6. Cookies, Tracking and Third-Party Content
We use no analytics, no advertising, and no tracking cookies. There is no third-party analytics service anywhere on our website and no cross-site tracking. The only cookie we set is the security token described in section 2, on the sign-in and dashboard pages.
Our pages load their fonts, icons, stylesheets and images from our own servers. Nothing about how a page looks is fetched from anyone else. Our delivery network, cdn.sealzi.com, serves the shared page furniture; it is our infrastructure, not a third party.
One service provider, named in section 5, is contacted only on the pages that need it:
- Stripe (stripe.com) — payment. Reached only when you start a checkout, and it is Stripe, never us, that receives your card details.
Signing in involves no third party at all. Passkeys are handled by Vauz, on our own servers. There is no identity provider behind the sign-in page, nothing is sent to one, and no component on that page reports to anyone. Signing in used to be handled by an outside company, it no longer is, and is handled by Vauz itself now.
Stripe carries nothing about your vault, and we do not use it to identify you. If you never buy anything, no request leaves our servers on your behalf — and signing in does not send one either.
7. Your Data Rights
Depending on where you live, you may have certain rights over the personal data we hold, including:
- Access: Request a copy of your data.
- Correction: Correct any inaccuracies in your data.
- Deletion: Request the deletion of your data.
These rights cover the account record described in section 2. They cannot extend to your vault, because we do not hold it. A copy of your vault is something only you can produce, from your own device, and deleting your account removes our record of you without touching anything on your machine.
To exercise these rights, please contact us at support@sealzi.com.
8. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, the date at the top of this page changes with it, and it is worth reviewing periodically.
9. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
Email: support@sealzi.com.
