VotVault privacy policy

Last updated: 20 October 2026

VotVault is a password and secrets manager made by Vot Labs. It is built so that we cannot read what you store: your data is encrypted on your own devices with keys derived from your master password and your Secret Key, neither of which is ever sent to us.

What we store on our servers

• Your email address, to identify your account.
• Your vault, encrypted on your device before it is uploaded. We cannot decrypt it.
• A value derived from your password and Secret Key that lets you sign in. It cannot be used to decrypt your vault.
• Technical metadata needed to sync: how many items you have, their approximate sizes, and when they change.
• Server logs of each request to our websites and servers: the time, the address requested, the result, your IP address and your browser's name and version. They never contain request bodies, your vault or any secret.

Server logs

We keep server logs for up to one year, to protect our services (spotting attacks and abuse, investigating incidents) and because Indian law requires us to keep security logs. They are stored encrypted in India and only we can access them. We also count visits from them — totals only, such as page views per day — to understand how our websites are used. We don't use cookies or tracking scripts, and we never use logs to follow you across the web, for advertising, or sell them.

What never leaves your device

• Your master password and Secret Key.
• The contents of your vault in readable form: passwords, notes, cards, one-time-code keys.
• Camera images when you scan a two-factor QR code.

Browser extension

The VotVault extension reads web pages only to fill your saved logins into them, and only on sites that match a saved login. If you turn on Inline autofill, it also detects login forms so it can show the VotVault icon and offer to save a login you just typed. The login you typed stays in your browser's memory until you choose to save it (encrypted) or dismiss the prompt; it is never sent to us in readable form. The extension does not track your browsing, does not collect analytics, and does not sell or share any data.

Breach checks

If you choose to check your passwords against known data breaches, VotVault sends only the first 5 characters of each password's SHA-1 hash to Have I Been Pwned (api.pwnedpasswords.com). The full password and full hash never leave your device.

Sharing and selling

We do not sell your data, show ads, or share data with third parties except the infrastructure providers that host our servers (DigitalOcean; Amazon Web Services for encrypted backups and server logs, in India).

Deleting your data

Signing out removes VotVault's data from that device. To delete your account and everything stored on our servers, contact us at the address below.

Contact

Vot Labs — privacy@votvault.com