Download

[ LEGAL WarPulse LLC ]

Vaulterm Privacy Notice

Last updated October 30, 2026

Vaulterm is built so we learn as little as possible about you and nothing about your servers. This notice adds to the WarPulse Privacy Policy, which covers every WarPulse product.

1. How this notice fits

This notice covers the Vaulterm app, the Vaulterm license server (api.vaulterm.com), license purchases and vaulterm.com. WarPulse LLC ("we", "us") is responsible for the personal data described here. It adds to the WarPulse Privacy Policy. Where they disagree about Vaulterm, this notice wins.

In particular, the anonymous usage analytics described in section 1 of the WarPulse Privacy Policy don't apply to the Vaulterm app. The one exception is update checks (section 3): they carry an anonymous install ID, used only to count installs. That isn't analytics of what you do in the app, and you can turn the checks off in Settings → Updates. If we ever add real usage analytics or crash reporting to Vaulterm, it will be off until you turn it on, and we'll update this notice first.

2. What stays on your computer

These stay on your computer. We don't receive them and can't read them:

  • Your vault: hosts, groups, identities, SSH keys, passwords, known hosts, snippets, tunnels and layouts, encrypted with your master password;
  • what you type, commands you run, terminal output and files you transfer;
  • network scan results;
  • "Your Vaulterm" usage counts, settings and themes;
  • your license file, which holds a signed license token and a secret for this device.

Uninstalling Vaulterm and deleting its data folder removes them.

3. What Vaulterm connects to

  • Your servers, directly. Connections don't pass through us.
  • Updates: Vaulterm checks for updates through our server, api.vaulterm.com (section 3a), and downloads them from GitHub Releases (github.com). If our server can't be reached, it may fall back to GitHub's update feed. GitHub then receives your IP address and the files requested, as it does for downloads, under GitHub's privacy statement.
  • Our license server, only once you activate or claim a license (section 4).
  • Links you click, such as Buy Pro or Manage on vaulterm.com, open in your browser.
  • Sync and built-in AI, when they're released and only if you use them (section 7).
  • Claude in Vaulterm Code and the extension store, both in the Beta channel, only if you use them (section 8).

3a. Update checks and counting installs

Each update check to api.vaulterm.com sends:

  • an install ID: a random UUID made on your device. It isn't derived from anything about you or your computer, and it's not the device ID of section 4;
  • the Vaulterm version, the update channel (Stable or Beta) and the platform.

What we keep: only a one-way hash of the install ID, for each UTC day it checked in, with the platform, channel and version. We keep it for 400 days. It lets us count how many installs are in use. We use your IP address only in memory, to limit abuse, and never store or log it.

Turning it off: turn off automatic update checks in Settings → Updates. The checks stop, so the counting stops. "Check for updates" run by hand still sends one check.

Why: to know how many installs are in use, so we can plan support and releases. For people in the EU and UK, our legal basis is our legitimate interest in counting installs.

4. Licenses and devices

Vaulterm contacts api.vaulterm.com to activate a license, to confirm it every few days, and to deactivate a device. It sends:

  • When activating: your license key, a device ID, the device name, the platform (Windows, Linux or macOS) and the Vaulterm version.
  • When confirming or deactivating: the license ID, the device ID and this device's secret.

About the device ID and name:

  • The device ID is a one-way hash of your operating system's machine ID. The machine ID itself never leaves your computer, and the hash can't be turned back into it.
  • The device name is there so you can recognize your devices in the list. You can change it, or leave it blank.

Free Pro for early users: claims closed on October 3, 2026. Until then, to claim it, Vaulterm sent the device ID, the Vaulterm version, the fact that a vault existed before the licensing release, and the date the oldest item in your vault was last changed. That's a date only, never the item. Adding your email to the claim was optional. Vaulterm 0.0.9 and later no longer send a claim. An older version may still try: the server answers that claims are closed and doesn’t store the claim.

The server keeps:

  • your license: its type, when it was created, and a hash of your key plus its last 5 characters. We don't store the key itself;
  • your devices: device ID, name, platform, when each was activated, last seen and deactivated, and a hash of each device's secret;
  • your purchases (section 5);
  • a log of changes to your license, such as activations, refunds and deactivations. It never holds a key, secret or token;
  • short-lived counters by IP address, used to limit abuse.

Why: to issue and check your license, enforce device limits, let you manage devices, and prevent fraud and key sharing. A license activated on more than 10 devices in 30 days is flagged for a person to review. Nothing happens to it automatically. For people in the EU and UK, our legal bases are performing our contract with you, and our legitimate interest in preventing fraud and abuse.

5. Payments and email

  • Stripe processes payments, and may be the seller (merchant of record) for a sale. Stripe collects your card or other payment details, billing country and the details tax law requires, under the Stripe Privacy Policy. We receive your email address, what you bought, the amount, currency and tax, dates, Stripe's IDs for you and the payment, and refunds and disputes. We never receive your card number.
  • Checkout pages: Stripe's script loads only on vaulterm.com's buy pages. It may collect information about your device and browser to prevent fraud.
  • Pro monthly and the AI add-on: we store each subscription's status, when the paid month ends, and whether it's set to cancel.
  • Email: we send your key, sign-in links for the manage page, a reminder 14 days before an Ultra license ends, and notices about your license, through Resend. Receipts and payment-failure notices come from Stripe. We don't send marketing email about licenses unless you ask for it.

Why: to sell and deliver licenses, handle refunds and disputes, and keep the accounting and tax records the law requires. Our legal bases are our contract with you and our legal obligations.

6. vaulterm.com

  • No analytics or advertising cookies. Fonts and images are served from vaulterm.com itself.
  • Hosting: Vercel hosts the site and the license server, and keeps request logs, including IP addresses, for a short time.
  • The waitlist keeps your email address and the platform you chose, only to tell you about Vaulterm. To leave it, email us.
  • Open-source Teams requests keep your name, email address, the project and its repository link, the seats you asked for and anything you wrote, to decide the request and reply. We email them to our licensing inbox.
  • Bot checks: the waitlist, the manage page's sign-in form, the open-source request form, and the account pages' email forms use Cloudflare Turnstile, which processes your IP address and browser signals to tell people from bots, under Cloudflare's privacy policy.
  • The manage page signs you in with a link emailed to you, valid for 15 minutes. It then keeps you signed in for an hour.

7. Accounts, sync and built-in AI

An account is optional. You need one for sync, and signing in to it brings your license to Vaulterm, so there's no key to type.

Your account

  • Your email address, confirmed with a code we email you.
  • How you sign in: each passkey's public key, name, and when it was made and last used (never a private key); or, if you use a password, a slow one-way hash of it (Argon2id), your authenticator app's secret, encrypted with a key only our server holds, and one-way hashes of your backup codes. We never store your password itself.
  • Sessions: for each device signed in, its one-way ID, its name, its platform and when it was last used, with a one-way hash of its sign-in token. Sign-ins on vaulterm.com last an hour.
  • A log of changes to your account, such as signing up, adding a passkey, removing a device or a reset.
  • A request to get your account back, if you ask us to reset it by hand: your email, when you asked, and our decision and the reason for it.

Sync

  • Your vault, encrypted end to end. Each item is sealed on your device with a key only your devices and your Recovery Key can open. For each item we keep a random ID, a version number, whether it's deleted, its size and when it changed. We can't see what kind of item it is, or any names, addresses, usernames, keys or passwords.
  • Earlier versions and deleted items, sealed the same way, so you can restore them.
  • Your Recovery Key's locked copy of your vault's key, which only your Recovery Key opens, and a one-way hash of a value only a device holding your vault's key can make. We never have your vault password, your vault's key or your Recovery Key.
  • Adding a device: its public key for the exchange, and your vault's key sealed to that device so only it can open it. A request ends after 10 minutes and is deleted a day later.

Why: to sign you in, keep your devices in sync, let you restore what changed, and stop abuse. Our legal basis in the EU and UK is performing our contract with you.

  • Built-in AI is opt-in, and not released yet. Vaulterm shows exactly what will be sent before sending it, and sends only that. We'll name the AI providers we use, and how long they and we keep what's sent, before AI is released.

8. Services you turn on

Two beta features of Vaulterm Code reach other services, and only when you use them. Both are in the Beta channel, which you choose in Settings → Updates.

  • Claude in Vaulterm Code (beta, Pro): when you send a message, your prompts, the files you mention and the results of Claude's tools go to Anthropic. They are sent with your own Anthropic API key and are under Anthropic's terms for that key: its Commercial Terms and Privacy Policy. Vaulterm does not receive or log them. On a project on a server, Claude runs on that server, and Vaulterm sends your key to it over your SSH connection after you allow it.
  • The extension store (beta): when you open the store, Vaulterm requests the Open VSX catalog through api.vaulterm.com/v1/openvsx, which passes the requests on to open-vsx.org, and the Official add-ons and the list of withdrawn add-ons from api.vaulterm.com/v1/addons. Open VSX sees our server, not your IP address. A request carries what you search for, and the extension you open or install. Vaulterm Code asks for the list of withdrawn add-ons when it opens and about every ten minutes while it stays open. Our server counts requests by IP address in the short-lived counters of section 4, to limit abuse, and requests may also appear in the hosting logs of section 6.
  • Updates: the Beta channel uses the same update feed host as Stable, so it adds no new host. See section 3.

Claude has no tool that reads your vault, and your vault is not sent to Open VSX.

9. Who we share data with

We don't sell your personal information, or share it for targeted advertising. We use these providers to run Vaulterm, and they may use the data only to provide their service to us:

  • Stripe: payments, tax and billing, and sometimes the seller;
  • Vercel: hosting for vaulterm.com and the license server;
  • Neon: the license, account, sync and waitlist databases;
  • Resend: email;
  • Cloudflare: bot checks on forms;
  • GitHub: hosting for Vaulterm's downloads and updates.

We may also disclose information when the law requires it, or to a company that takes over Vaulterm, which would have to follow this notice.

10. How long we keep it

  • Licenses, devices and the change log: as long as the license exists. After that, only what the next item needs.
  • Purchases and tax records: as long as tax and accounting law requires, which can be up to 10 years for EU VAT records.
  • Sign-in links and sessions: deleted within a day of expiring.
  • The key shown after payment: kept sealed for an hour so the page can show it, then deleted.
  • IP address counters: deleted after 2 days.
  • Update check counts: a hash of the install ID, with the day, platform, channel and version, for 400 days.
  • The waitlist: until you leave it, or until we've told you Vaulterm is available for your platform.
  • Open-source Teams requests: as long as the license they lead to is in use. Ask us to delete a refused one at any time.
  • Your account: until you delete it. Email codes work for 10 minutes, and they and other sign-in steps are deleted a day after they end. A device's session is deleted a day after it ends, or 30 days after it's signed out. Requests to get an account back are kept with the account.
  • Your synced vault: until you delete the cloud copy or your account. Earlier versions and deleted items are kept for 90 days. If it holds more items than your plan syncs (after a license ends, say), sync pauses and we keep the copy for 180 days, email you 30 and 7 days before, and then delete it, unless it's back under the limit by then.
  • Hosting logs: as long as Vercel keeps them, which is short.

11. How we protect it

  • License keys and device secrets are stored only as keyed hashes.
  • License tokens are signed, so they can't be forged, and each one works only on its own device.
  • The server uses a restricted Stripe key, and never logs a key, secret or token.
  • Your vault is encrypted on your devices before it's sent, so a break-in at our end can't read it. Account passwords need an authenticator app too, and are checked against known breaches when they're set.
  • Everything is sent over HTTPS.

No system is perfectly secure, but we design for that: the most sensitive data, your vault, never reaches us.

12. Your rights

Depending on where you live, you can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct it;
  • delete it;
  • limit how we use it, or object to our use of it.

Email [email protected] from the address you bought with, so we can confirm it's you. We answer within 30 days, and we won't treat you differently for asking.

Deleting license data ends the license, because we can no longer confirm it. We may keep purchase records the law requires us to keep. Your email address, devices and everything else are deleted within 30 days.

You can delete your account yourself at vaulterm.com/account: your synced vault, its history, your ways to sign in and every session go at once. Your licenses stay with your email, and each device keeps its own vault.

  • In the EU or UK, you can also complain to your data protection authority.
  • In California, you have the right to know, delete and correct your personal information, and we don't sell or share it.

13. International transfers

WarPulse and its providers are in the United States and other countries. When data about people in the EU, UK or Switzerland is sent to the US, we rely on our providers' Data Privacy Framework certification or standard contractual clauses, as section 8 of the WarPulse Privacy Policy describes.

14. Changes to this notice

The date at the top shows the latest version. We'll tell you about important changes in Vaulterm, on this page, or by email if you've bought a license, before they apply.

15. Contact

WarPulse LLC, United States. Children's privacy follows section 7 of the WarPulse Privacy Policy.