What we keep, what we cannot read, and who else is involved.

Your account

Your email address, which is how you sign in. A hash of a value your device derives from your master password, which lets us check a sign-in without learning the password. The settings your device uses to derive keys, your keys in encrypted form, whether you have set up a recovery key, when the account was created, and whether you asked for security alerts by email.

Your vault

Items, folders, attachments and settings, all encrypted on your device. We cannot see names, usernames, passwords, websites or notes. We can see how many items you have, when they change, and roughly how large an attachment is.

Signing in, and your devices

• A record for each signed-in device: when it signed in, when it expires, and when it was last used, to the hour. Device names are encrypted.
• A device identifier your device makes up from a random value it keeps, so we can tell you about a sign-in from a new device. It is not your hardware’s serial number or advertising ID.
• Security events, such as a new device signing in or your password changing: the kind of event and when it happened.
• A count of recent failed sign-ins, so repeated guessing can be slowed down.

Two-step sign-in

If you use an authenticator app, we store its secret in a form we can use to check your codes, because that is how those codes work. Recovery codes are stored hashed. For a security key we store its public key and a usage counter; its name is encrypted.

Sharing, organizations and emergency access

What you share stays encrypted, but we can see who shares with whom, the permission given, who belongs to which organization and in which role, and for emergency access, who the contacts are, the waiting period and when access was requested. Your public keys are published so that others can share with you by entering your email address.

Send

A Send is stored encrypted, with its expiry, view limit and view count. The key is in the link you share and never reaches us. It is deleted on its deletion date, at most 31 days after it was made, or sooner if you delete it.

What we do not store

Your master password, the contents of your vault, the websites you keep, your IP address or your browser’s user agent. The network address a request arrives from is held in memory for a short time to limit repeated attempts, and is never written to the database.

Logs

Our web server keeps an access log for 14 days: the time, the address requested, the response, and your browser’s user agent. The address requested can include an email address, when you look up someone’s public key to share with them. Because traffic reaches us through Cloudflare, the IP address in that log is Cloudflare’s, not yours. The application logs errors, not requests.

In your browser

The web app keeps your display settings, a random value that identifies this device to your account, and any warnings it has shown you. If you turn on the offline copy, which is off by default on the web, it also keeps your vault in its encrypted form. Your unlocked vault and your session stay in memory and are gone when you lock or close it.

Extension, desktop and Android

The apps keep an encrypted copy of your vault so it opens without a connection. This is on by default in the extension, the desktop app and on Android, and can be turned off in settings. If you unlock with a PIN or your fingerprint, the apps keep what that needs on the device, never the master password. The Android app is excluded from phone backups.

• Your account and vault: until you delete them.
• Deleted items: in the trash for 30 days by default, or the period you set, then removed.
• Send: until its deletion date, at most 31 days.
• Signed-in device records: until you sign out, remove the device, change your master password or delete your account.
• Security events: until you delete your account.
• Web server access logs: 14 days.
• Copies of the database made before maintenance, such as an upgrade, hold the same encrypted data and are deleted once they are no longer needed.

Deleting your account

You can delete your account from the app’s settings. It removes your vault, devices, sign-in methods, Sends, shares and security events. Items you added to an organization stay with that organization. Deleted data can remain in the database’s storage until it is overwritten.