Lockvero (“we”) operates Lockvero, a zero-knowledge password manager. This policy explains what we process and why. The short version: we cannot read your vault, and we collect only what we need to run the service.
1. Your vault is end-to-end encrypted
Everything you store — project names, titles, URLs, usernames, emails, passwords, PINs and notes — is encrypted on your device before it is sent to us. We store only ciphertext. We never receive your master password, your encryption keys or your recovery key, and we cannot decrypt, view, sell or hand over the contents of your vault. See our security page for details.
2. Information we process
- Account data: your email address, language, a hash of a key derived from your master password (never the password itself), key-derivation parameters, encrypted keys, and your public sharing key.
- Security data: two-factor settings (encrypted authenticator secret, passkey public keys), active sessions, and a security log of events such as sign-ins, including IP address, browser user agent and time.
- Billing data: your plan, its validity dates and payment references. Payments are processed by our payment provider on its own pages; we never receive your card details.
- Sharing data: who you share a project with, their role, and encrypted copies of project keys.
We do not use advertising trackers, analytics cookies or third-party scripts on this website or in the app.
3. Why we process it
- To provide and sync your vault and keep your account secure (performance of our contract with you).
- To detect and prevent abuse, such as brute-force sign-in attempts (our legitimate interest in security).
- To send service emails: verification, security alerts, sharing invitations and plan reminders. We do not send marketing email without your consent.
- To meet legal and tax obligations for payments.
4. Breach checks
When you run the password health report, your browser sends only the first five characters of a SHA-1 hash of each password to the Have I Been Pwned service (k-anonymity). Neither we nor that service learn your passwords.
5. Sharing with others
We use a small number of processors to run Lockvero: hosting, email delivery and payment processing. They receive only what they need for that purpose. We do not sell personal data.
6. Retention and deletion
You can delete your account at any time from Settings. Deleting your account permanently removes your vault, projects and keys. Encrypted backups expire on their normal rotation. We keep billing records for as long as tax law requires.
7. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data and to object to certain processing. You can export your vault yourself at any time. For other requests, contact support@lockvero.com.
8. Children
Lockvero is not directed at children under 13. Family plan members under the age of digital consent must be added by a parent or guardian.
9. Changes
We will post updates here and, for material changes, notify you by email before they take effect.
10. Contact
Privacy questions: support@lockvero.com. Security reports: security@lockvero.com.