Privacy Policy
Last updated November 4, 2026
Keyvela is a password manager made by UlfApp Software LLC, an Indiana limited liability company (“we”, “us”). This policy explains what we collect, why, and what we can and can’t see. The short version: your vault is encrypted on your device with a key made from your master password, and we never receive that password or that key. We can’t read your passwords, notes or cards, and neither can anyone who gets into our servers.
1. What we can’t see
Everything you store in your vault (logins, passwords, website addresses, 2FA keys, cards, notes, and the names of your categories) is encrypted in your browser with AES-256-GCM before it is sent to us. The key comes from your master password (PBKDF2-SHA256, 600,000 rounds) and never leaves your device. We store only the encrypted result.
2. What we do collect
| Information | Why |
|---|---|
| Your email address and, if you give it, your name | To identify your account, sign you in, and contact you about it |
| A one-way Argon2id hash of a sign-in key your browser derives, plus the salt and settings used to derive it | To check it’s you when you sign in, without ever knowing your master password |
| Your encrypted vault | To keep it in sync across your devices |
| App preferences (auto-lock time, theme, generator defaults) | To apply them on every device |
| Subscription details from Stripe: customer and subscription IDs, plan, status and renewal date | To know whether your plan is active |
| The IP address and time of sign-in attempts | To block password-guessing; kept for 30 days |
| Standard web server logs (IP address, browser, pages requested) | To run and secure the service; kept by our host for a limited time |
We don’t use advertising, analytics or tracking cookies, and we don’t load third-party scripts on this site or in the app. The app sets one essential cookie that keeps you signed in, and stores your email address on your device so you don’t have to retype it.
3. Payments
Payments are handled by Stripe. Your card details go directly to Stripe and never reach us. Stripe’s privacy policy applies to the information you give them at checkout.
4. Who else handles data
| Company | What they do |
|---|---|
| Hostinger International Ltd. | Hosts the website, app and database (your encrypted vault) |
| Stripe, Inc. | Checkout, subscriptions, receipts and billing |
| Cloudflare, Inc. | Domain name service and network delivery for keyvela.app |
We don’t sell or rent your information, and we don’t share it with anyone else unless the law requires it. Even then, your vault is encrypted and we have no way to decrypt it.
5. How long we keep it
We keep your account while you have one. You can delete it any time in Settings (after cancelling your subscription); that immediately erases your account and vault from our live database. Copies in our host’s backups roll off within 30 days. Stripe keeps billing records as the law requires.
6. Your choices
- Export your whole vault any time from Settings → Import & export.
- Change your master password, or delete your account, from Settings.
- Ask us what we hold about you, or to correct or delete it: email support@ulfapp.com.
7. Security
Besides encrypting your vault on your device, we use HTTPS everywhere, lock out repeated failed sign-ins, sign out your other devices when you change your master password, and lock the app automatically when you step away. No system is perfect; if we ever learn of a breach that affects you, we’ll tell you promptly.
8. Children
Keyvela isn’t meant for children under 13, and we don’t knowingly collect their information.
9. Changes
If we change this policy, we’ll update the date above, and for significant changes we’ll let you know by email before they take effect.
10. Contact
UlfApp Software LLC, Greenwood, Indiana · support@ulfapp.com