Privacy policy
Effective 3 October 2026. Applies to the DreyVault server software, web vault, browser extensions and this website.
Short version: DreyVault has no central service. Your vault lives on a server you or someone you trust runs. We (the DreyVault developers) never receive your vault, your passwords or usage data, and the software contains no telemetry, analytics or ads.
Who holds your data
Whoever runs your DreyVault server (you, a family member, your organization) is the operator of that server and is responsible for it. The DreyVault developers have no access to any server and no copy of any vault.
What is stored where
| Where | What | Readable by the server operator? |
|---|---|---|
| Your server | Vault items, attachments and Send files, encrypted on your device before upload (AES-256-GCM) | No |
| Your server | Item titles, kept unencrypted so the server can search them | Yes |
| Your server | Username, optional email, an authentication hash (not your master password), public keys, signed vault manifest, enrolled biometric/security-key credentials | Yes (none of it reveals your password or vault contents) |
| Your server | Sessions (device name, IP address, last seen) and a security log (sign-ins, failures, changes, with item IDs and titles but never secrets) | Yes |
| Your server's backups | An encrypted copy of the above, at the targets the operator chooses (disk, S3/R2, WebDAV, Google Drive, Dropbox) | Only with the backup passphrase; vault items stay end-to-end encrypted either way |
| Your browser / device | Server address, settings, sign-in session and an encrypted offline copy of your vault (extension storage or browser storage) | Not applicable |
Your master password and the keys derived from it never leave your devices.
What DreyVault never does
- No telemetry, analytics, crash reporting, advertising or tracking in the server, web vault or extensions.
- The extension reads pages only to find login fields and fill them on your request, and talks only to your server.
- No data is sold or shared with anyone.
Connections to other services
Only when the operator or you turn them on:
- Update check: the server fetches
https://dreyvault.abhishekm.work/version.jsonto show when an update is out. The request carries no account data. Operators can turn it off (UPDATE_URL=off). - Breach checks: password checks use Have I Been Pwned's k-anonymity range API (only the first 5 characters of a SHA-1 hash are sent). Email breach alerts send your email address to Have I Been Pwned, only if the operator adds an API key and you opt in.
- Email: notifications go through the operator's SMTP server and never contain vault data.
- Email aliases: if you connect an alias provider, the alias request goes to that provider.
- Backups: encrypted backup files go to the targets the operator configures.
This website
dreyvault.abhishekm.work is a static site on Cloudflare Pages. It sets no cookies and runs no analytics. Cloudflare processes standard request logs (IP address, user agent) to deliver and protect the site, under Cloudflare's privacy policy. Send links are never opened on this site (why).
Your rights
Your account and data are on your operator's server: you can export your vault and delete your account from your account settings, and the operator can delete accounts. For anything else, contact the operator of your server. For questions about the software, open an issue at github.com/DreyFvR/dreyvault.
Changes
Changes to this policy are listed in the changelog, with a new effective date above.