Privacy Policy

Overview

Citadel Vault is a password manager and authenticator. Your vault contents are encrypted before they sync. We operate the service, authenticate your account, and help you recover access — but we cannot read your saved passwords or TOTP secrets.

If a feature requires optional diagnostics or support logs, we describe it in-product and keep collection limited to what is needed to run the service.

What we collect

• Account information — email address and password credentials you provide when you sign up or sign in.
• Vault data — logins, secure notes, attachments, cards, and authenticator secrets you choose to store. Vault payloads are encrypted client-side before sync.
• Service logs — basic operational data such as request timestamps, error reports, and performance metrics needed to secure and maintain Citadel Vault.

How we use data

We use your information to:

• Provide, sync, and secure your vault across extension, web, and desktop surfaces
• Authenticate you, send account recovery links, and respond to support requests
• Detect abuse, protect accounts, and improve reliability

We do not sell your personal information or vault contents.

Encryption

Citadel Vault uses zero-knowledge encryption for vault contents. Only you can unlock your vault with your account credentials and optional vault passcode. We cannot decrypt your saved items on our servers.

Sharing

We share data only with infrastructure providers that help us run Citadel Vault — for example, hosting, database sync, and transactional email — and only as needed to provide the service. We may disclose information if required by law or to protect users and the service from fraud or abuse.

Your choices

You can export your vault from Settings, update account details, or request account deletion by contacting us. Optional features such as vault passcode and auto-lock remain under your control.