Privacy statement

• Your email address, and whether you have confirmed it.
• Your legal first name, legal last name and date of birth.
• Your unique @handle, which is private by default.
• Authentication material: passkey public keys, verification-app enrolment, and one-way hashes of backup codes.
• Devices you explicitly register, described only by coarse browser, operating system and platform family.
• Security events: what happened, when, and the outcome.
• In-app security notifications.

• Documents, credentials, crypto material, recovery instructions or any other vault content.
• Encryption keys of any kind.
• Your password or your backup codes in readable form.
• Contact lists, tracking profiles or advertising identifiers.

Security events are kept for 24 months. Raw network identifiers attached to those events are minimised after 90 days. Administrative audit is minimised rather than deleted, so the record of a governed decision cannot disappear. Retention runs on a schedule and each run is written to a maintenance ledger.

Authentication email is delivered by the managed platform email capability using the bobbyvault.com sending identity. Application security-notification email is a separate capability and is currently inactive; while it is inactive, security notifications are shown in the product only.

You can view and correct your personal details, register and revoke devices, revoke sign-in keys, regenerate backup codes, end every session, and read your own security history from your account page. Platform staff cannot read a private handle directory, cannot sign in as you, and cannot disable your protections outside a governed recovery process that is not built yet.

Bobby Vault does not claim to be zero-knowledge. Where a specific capability is proven to be client-side encrypted, it will be described in those precise words and no wider.