Legal
Written from the actual data model. Every claim below describes what the code does, today.
Your secrets are encrypted in your browser before they leave it, and the server stores ciphertext it cannot decrypt. The guest tool stores nothing at all. There are no analytics, no trackers, no advertising, and no third parties receiving your data.
Your email address, so you can sign in and be contacted about orders and support. An Argon2id hash of an authentication key derived from your password, so sign-in can be verified without ever seeing the password itself. Key derivation parameters, so the math stays consistent. The wrapped vault key, which is ciphertext that only your master password can unwrap. Your vault folders and entries as AES-256-GCM ciphertext plus initialization vectors. Session records for staying signed in, and operational timestamps like creation and update times.
Your master password, your vault encryption key, and the contents of your vault. The encryption happens in your browser using standards-based key derivation. Anyone inspecting the server or its database, including us under subpoena, finds encrypted blobs with no decryption path.
Nothing. The homepage tool runs entirely in your browser, makes zero data-bearing network requests, writes nothing to storage, and forgets everything on reload. You can verify both claims in your browser's network and storage inspectors.
One functional cookie: the session cookie that keeps you signed in. It is marked HttpOnly, Secure, and SameSite. There are no tracking cookies, no consent banner, because there is nothing to consent to.
Standard operational logging at the infrastructure level, such as request timing and error rates. Logs are kept for reliability and security investigations and are not used to profile you.
None. No analytics providers, no advertising networks, no fonts or scripts loaded from other domains. The Content-Security-Policy on every page blocks outbound connections to anywhere but this site by construction.
Delete your account from the account page and the stored data is removed: email, ciphertext, sessions. Support can also do it for you by email from your registered address. Residual backups, if any exist at the infrastructure level, age out on their normal schedule and contain only ciphertext.
The service is not directed at children under 13, and accounts are not created for them.
If this policy ever changes in a way that matters, the change is announced on the site before it takes effect. Questions go to support@dependsit.com. Last updated November 2026.