Privacy

Privacy Policy

Effective: October 27, 2026 · Wundervault

We built Wundervault to be private by default. This policy explains what data we hold, why, and what never reaches us.

Zero-Knowledge Architecture

Your secrets are encrypted on your device before they leave it. We store only ciphertext — we have zero knowledge of your vault contents and cannot decrypt them even if compelled to. Your vault passphrase and your Account Key are never transmitted to our servers. This is by design, not policy — it is technically impossible for us to access your secrets.

Your agents use your secrets through a broker that runs on your own computer. For secrets set to run without asking, the record of where a secret was sent, and the reason your agent gave for using it, is kept in the broker's log on that computer — not on our servers. That log is kept on your computer for a year. For secrets set to "ask me first", we show you the destination and the agent's reason so you can decide, so we hold them only while they are needed: the reason until you decide, the destination until the approval is used up (see below).

What We Collect

Email address — for your account, sign-in, verification, security notices, and the newsletter if you choose it
Account password — stored only as a bcrypt hash, and deleted once you add a passkey
Encrypted vault data — encrypted in your browser with AES-256-GCM; we cannot read it
Names of your secrets and agents — so your dashboard can show them
Activity log — which agent used which secret, when, the outcome, and the network (IP) address the request came from. Not the reason your agent gave, and not where a "run without asking" secret was sent. Kept 30 days by default; you choose 30, 60, 90 days or a year in Settings → Data
"Ask me first" approvals — for each request you are asked to approve: the destination (web address, method and path), the reason your agent gave, and your decision. The reason is erased when you decide, and the destination once the approval can no longer be used
Payments and signatures waiting for you — the payee and amount, or what is to be signed, held only until you decide or the request expires
Fingerprints of your computer's log — the broker on your computer keeps a full log of every use of a secret; we receive only a fingerprint of each line, which reveals nothing about what it says, so a changed log can be detected. We keep the latest one for each computer, and how far the log had reached at the end of each month for the last 14 months (so we can tell when its old lines may be removed), until you delete your account or start a new record
Passkey and broker public keys — passkey (WebAuthn) metadata for biometric unlock, and the public keys of the brokers you pair; neither contains secret data
Account preferences — settings you configure in the dashboard

What We Don't Collect

Plaintext secrets — ever
Your vault passphrase or Account Key — never transmitted to our servers
Where your "run without asking" secrets are sent, or the reason your agent gave for using one — that stays on your computer
Device fingerprints or tracking identifiers
Browsing history or cross-site behavior
Any data for advertising purposes

Cookies and Browser Storage

We use two cookies, both required: an httpOnly session cookie that keeps you signed in, and a security cookie that protects dashboard forms from cross-site request forgery. We do not use tracking cookies, analytics cookies, or advertising cookies.

Your browser also stores your Account Key and small settings such as light or dark mode. These stay in your browser and are never sent to us.

If you opt in to the Wundervault newsletter — during registration or via the newsletter signup page — your email address is kept in our own newsletter system, run on our servers, solely to send you the newsletter. Issues are delivered through Resend, the email service listed below. You can unsubscribe at any time using the one-click link in any newsletter email.

We do not share your email for any other purpose and do not combine newsletter subscription data with your vault usage data. The newsletter is separate from your account: deleting your account does not unsubscribe you. Turn it off in Settings before you delete, use the link in any issue, or ask us to remove you.

Third-Party Services

Resend — email delivery (verification codes, password resets, security alerts, the newsletter, and messages sent through our contact form). Receives your email address and the message, for delivery only.
Cloudflare — network and DNS provider in front of wundervault.com, so it handles the IP address and request details of every visit; its Turnstile check also runs on the sign-up form to stop automated sign-ups.
Oracle Cloud — hosts our servers and database.
No third-party analytics. No ad networks. No data sold or shared beyond what is described above.

Data Retention

Routine activity — kept for the window set on your account (30 days by default, up to a year), then deleted. Deletion is enforced in code, both when you open your log and by a daily sweep across every account
Security events — approvals, denials, revocations and anything blocked are kept for 365 days regardless of that setting, because they are what answers "what happened" after an incident
"Ask me first" approval records — the reason your agent gave is erased when you decide. The destination is erased when the approval can no longer be used: denied, revoked, expired, a one-time approval used, or a time window closed. What remains (which agent asked, for which secret, when, and what you decided) is kept with your account until it is deleted
Payment and signature details — erased when you decide or the request expires. A backup taken in the meantime keeps a copy until that backup is deleted
Encrypted vault data — retained until account deletion
Earlier values of a secret — when you replace a secret, the old value is kept for 30 days so you can put it back, encrypted with your key like the current one. You can forget one sooner from the secret's page. Deleting the secret deletes them
Labels you add — a secret's tags, and how it is sent (for example "a bearer token" or "a header named x-api-key"), are stored as you typed them, like its name. Where a secret is sent is not: that stays on your computer
Email address — retained until account deletion, or until you unsubscribe (for newsletter-only)
Backups — copies of our database, kept for up to 60 days and then deleted. Your vault's contents in them stay encrypted with your key, as they are on our servers. Anything you delete, including your whole account, is gone from every backup within 60 days

Security

All data in transit over TLS
Vault encryption: AES-256-GCM. The key comes from your passphrase, stretched with Argon2id (PBKDF2 on browsers that block WebAssembly), combined with an Account Key that never leaves your device
Account passwords hashed with bcrypt (cost factor 13)
Zero-knowledge architecture — vault key never known to server

Your Rights (GDPR)

Right to access — you can view your account data in the dashboard
Right to erasure — deleting your account removes your account data from our servers at once, and from our backups within 60 days. A newsletter subscription is separate: unsubscribe from any issue, or ask us and we will remove it
Right to rectification — contact us to correct inaccurate account data
Right to portability — export your encrypted vault and your activity log from the dashboard
Right to object — you may opt out of the newsletter at any time; we have no other marketing uses of your data

Children's Privacy

Wundervault is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with their data, please contact us so we can delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted with a new effective date. Continued use of the service after changes take effect constitutes acceptance.

Contact

Privacy questions or data requests: send us a message.