Privacy Policy
Effective date: June 2025 · Operated by WorthHallBooks
Overview
CipherVault is a zero-knowledge password vault and generator. This policy explains what data we collect, how it is protected, and what we never do with it.
The short version: Your passwords never leave your device in readable form. We cannot read your vault. Nobody can — not even us.
What We Collect
| Data | Where it lives | Who can read it |
|---|---|---|
| Your master password | Device memory only — never stored or transmitted | You only |
| Your plaintext passwords | Never leaves your device | You only |
| Encrypted vault entries | Device (localStorage) + cloud sync | You only |
| Account email address | Authentication service (signed-in users only) | WorthHallBooks |
| App usage analytics | Not collected | Nobody |
How Your Data Is Protected
CipherVault uses a zero-knowledge encryption model. This means:
- All encryption and decryption happens entirely on your device, inside your browser or app.
- Your master password is used locally to derive an AES-256 encryption key via PBKDF2 (200,000 iterations, SHA-256). It is never stored on disk or transmitted to any server.
- Vault entries are encrypted using AES-GCM 256-bit encryption before they leave your device.
- Only encrypted ciphertext is ever synced to our cloud backend. The server receives data it is mathematically unable to read.
- All password generation uses the Web Crypto API (
crypto.getRandomValues) — never the weakerMath.random().
Cloud Storage (Signed-In Users)
If you create an account and sign in, your encrypted vault is synced to secure cloud servers provided by Base44. This enables cross-device access to your vault.
Important: Base44 servers store only your encrypted vault data. At no point does Base44, WorthHallBooks, or any third party have access to your master password or the plaintext contents of your vault.
Guest users (not signed in) store vault data exclusively in their device's local storage. No data is transmitted to any server in guest mode.
Master Password Recovery
Because CipherVault is zero-knowledge by design, your master password is never stored or transmitted anywhere. This means:
- We cannot reset your master password for you.
- We cannot recover your vault if your master password is lost.
- If you forget your master password, your encrypted vault data cannot be decrypted by anyone.
We strongly recommend storing your master password securely. This is a deliberate security property, not a limitation.
Third-Party Services
CipherVault uses the following third-party services:
- Base44 — provides authentication and encrypted cloud storage. Only ciphertext is transmitted. Base44's own privacy policy governs their handling of account data.
We do not use advertising networks, tracking pixels, analytics SDKs, or any service that profiles users for commercial purposes. CipherVault contains no advertisements.
Children's Privacy
CipherVault is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
Your Rights (UK & GDPR)
As a user based in the United Kingdom or European Union, you have the right to access, correct, or request deletion of any personal data we hold about you (such as your account email address). To exercise these rights, contact us at the address below.
Because your vault contents are encrypted and inaccessible to us, deletion of your account will permanently destroy your encrypted vault data.
Changes to This Policy
We may update this policy from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of CipherVault after changes are posted constitutes acceptance of the updated policy.
Contact
Questions about this policy or your data? Get in touch:
Email
admin@worthhallbooks.com
Operated by
WorthHallBooks, Macclesfield, Cheshire, United Kingdom