Saved secrets and local files
- Plaintext saved and generated passwords
- Your two-part Master Key and live Master Key session
- Passkeys, secure notes, and files kept in the local vault
- A recovery phrase and the authority needed to open its backup
Privacy
Vaultless Privacy Policy
What stays on your device, what Vaultless and service providers process, and how deletion differs by feature.
The boundary
What stays on this device, and what leaves it
Vaultless is local-first, not server-free. The app keeps the working copy of sensitive vault data on your device and uses online services only for features that need them.
Service data
- Aliases, forwarding destinations, and pseudonymous owner state
- Recovery-account email, verification, session, and reset records when you use a recovery sign-in
- Web Mail approval and session records, passkey public keys, and random sign-in identifiers when you use browser mail
- Ordinary email, attachments, routing, delivery, and abuse records
- Assigned phone numbers, incoming text content, sender numbers, and delivery records when incoming texts are connected
- Push registrations, subscription entitlements, and support requests
- Authenticated recovery ciphertext when online recovery is enabled
Account-free is an identity choice, not an offline mode.
Using aliases or Mail creates a pseudonymous service identity so Vaultless can route data to the right installation without requiring a new recovery account.
Mail
Ordinary mail and shared-key mail are different
Ordinary email is not end-to-end encrypted. Vaultless, its mail and hosting providers, and the recipient's provider necessarily process routing data and message content to store and deliver it.
Optional shared-key mail protects the subject, body, and attachments from Vaultless and mail providers. Routing metadata remains visible. The shared key is entered locally and is not sent to Vaultless. Anyone with that key can decrypt the package, and support cannot recover a lost key.
Incoming texts
A separate number for your incoming texts
Connecting a test number lets Twilio, phone carriers, and Vaultless process its incoming text content and addressing information. Ordinary SMS is not end-to-end encrypted. Vaultless does not download message attachments in this test, and some websites do not accept virtual phone numbers.
Vaultless keeps the newest 200 texts for up to 30 days. Deleting a text removes its content from the active Vaultless service; a delivery receipt remains until its original 30-day deadline to prevent duplicate delivery. Your devices keep encrypted local copies, and an offline device may retain its copy until it next synchronizes or you erase its local data.
Disconnecting stops receipt in Vaultless and removes its stored texts. The administrator must separately release the rented Twilio number to stop provider charges. Deleting the service identity also clears its phone records. A number retirement marker without text content or an owner link remains to prevent reassignment. Twilio and carriers control their own retention; deleting from Vaultless does not delete their records.
Providers
Who processes service data
Each provider receives only the data needed for the current feature.
| Provider | Current purpose and data |
|---|---|
| Cloudflare | Worker requests, pseudonymous owner state, D1 application data, access control, and operational logs. |
| Resend | Email addresses, ordinary mail content and attachments, delivery state, bounces, and complaints. |
| Twilio and phone carriers | Rented phone numbers, incoming text content, sender and recipient numbers, and messaging delivery records when incoming texts are used. |
| Have I Been Pwned | The complete address selected for a breach check after consent. Passwords and Master Keys are never sent for this check. |
| EasyPost | A tracking number and carrier data only when delivery tracking is used. |
| Apple, APNs, and Expo | App or platform identity, push tokens, and opaque notification identifiers. |
| Apple and RevenueCat | Entitlement state tied to a pseudonymous owner identifier when purchase functionality is configured or used. Current purchase availability remains in release validation. |
A provider may retain limited security, legal, billing, or disaster-recovery records under its own policy. That provider-controlled retention is outside the app's direct deletion control.
Your choices
Monitoring and notifications start off
Breach monitoring
When you enable it, Vaultless enrolls the verified forwarding address and active aliases. Complete addresses are sent to the breach provider only for that check.
Push notifications
Push payloads contain an opaque alert identifier, not an alias, monitored address, mail subject, preview, or breach detail. Detail loads after the app is unlocked.
Vaultless does not sell personal data, run advertising SDKs, use data brokers, or perform cross-app advertising tracking.
Deletion
Different data has different deletion actions
Alias retirement, moving mail to Trash, Delete forever, recovery-snapshot deletion, device-owner destruction, and deletion of an existing recovery account are distinct actions. A local reset is not a promise that every server-side record has been deleted, and a service deletion is not a promise that the local vault was erased.
- Mail in Trash can be restored during its recovery window. Delete forever is the separate permanent action.
- An existing recovery account can be deleted in Settings → Vaultless Account → Delete account. That removes the compatibility account, server aliases, stored mail, recovery snapshots, sessions, and push registrations; the local password vault stays on the device.
- Mail and owner tombstones remain only for the bounded reconciliation period needed to stop stale clients from restoring deleted data.
- Administrative audit and mail-abuse records are retained for up to 90 days. A documented incident or legal hold can require longer retention.
Deleting active data cannot recall mail already delivered to another provider or instantly erase provider disaster-recovery copies.
Questions
privacy@vaultlessmail.com
Contact privacy
Ask about these practices or a deletion workflow without including a password, Master Key, recovery phrase, or backup file.