GrailVAULT Privacy Policy

Last updated: 7 October 2026
Also published at https://www.grailvault.in/privacy/

WHO WE ARE
GrailVAULT is a product of Genesys Research & AI Labs ("we"), part of the GRAIL family of products. We operate the GrailVAULT app (https://app.grailvault.in), this browser extension and our website, and this policy covers all three.

GrailVAULT is built so that we cannot read your passwords. This policy explains what we store, why, who helps us run the service, and how you can have everything erased.

SUMMARY
- Your vault (logins, cards, notes and everything else you save) is encrypted on your device before it reaches us. We store only the encrypted result and cannot decrypt it.
- We never receive your master password or your recovery key.
- We store your email address, your plan, and a short security activity log. We do not sell data, show ads or use trackers.
- You can delete your account yourself at any time, in Settings.

WHAT WE STORE
- Your email address: to sign you in and to send your sign-up code and notices about your account.
- Your encrypted vault (every item, tag, and your profile name and picture): to give your vault back to you on any device. We cannot read it.
- Sign-in and recovery keys in protected form (a hash of your login proof, and your vault key wrapped by your password and by your recovery key): to let you sign in and recover access. They are useless without your password or recovery key.
- Plan and billing status (plan, trial end, paid-until date, a subscription reference): to apply your plan and the free trial.
- Sign-in sessions (when, from which browser and IP address): so you can see and end your sessions and to protect your account.
- A security activity log (for example sign-ins, password changes, two-factor changes, plan changes) with time, IP address and browser, limited to the newest 500 events from the last 180 days. It never contains vault contents or item names.
- The size of your vault, the number and size of items, and timestamps: to enforce limits and keep the service running. We cannot see the contents.
- Two-factor and device-unlock settings (a sealed authenticator secret, backup-code hashes, the public part of any passkey).
Our server logs record requests for security and troubleshooting. They do not record request bodies, cookies or tokens.

WHAT WE DO NOT DO
- We do not read, scan, analyse or sell your vault.
- We do not use advertising or analytics trackers. Our website sets no cookies. The app sets one secure session cookie, only so you stay signed in.
- We do not share your data with advertisers or data brokers.

THE BROWSER EXTENSION
The extension fills and saves logins. To do that it:
- reads sign-in forms on the pages you visit, only when you click its controls, to fill a login or to offer to save one. Page content is not sent anywhere except the login you choose to save, and that goes to our server only in encrypted form;
- talks only to https://app.grailvault.in;
- keeps your vault key and session in the browser's temporary storage, which is cleared when you close the browser or lock the extension; and
- stores locally which sites you told it never to offer to save.
The extension collects authentication information (your saved logins, sent encrypted) and your email address (to sign in). It does not track your browsing and does not send the pages you visit to us.

WHO PROCESSES DATA FOR US
- Hosting: our server and database run on a virtual private server we rent. Everything stored there is as described above, with your vault encrypted.
- Payments: Razorpay. When you pay, you go to Razorpay's page. Your card, UPI or bank details go to Razorpay and never reach us. We receive confirmation that a payment succeeded and your subscription reference. Razorpay's own privacy policy applies to what it collects.
- Email delivery: we send sign-up codes, security notices, trial reminders, payment confirmations and occasional service messages through an email service provider, which processes your email address and the message.
- Breach check (optional): the security check can ask whether a password appeared in known breaches. Your device sends only the first five characters of a one-way fingerprint of the password, never the password, to the Have I Been Pwned range service through our server.

HOW LONG WE KEEP DATA
- While your account exists: your account data, encrypted vault and activity log as described above.
- If your trial or plan ends: your vault is kept and stays readable and exportable. We never delete it because a plan ended.
- When an account is deleted (by you in Settings, or by us when you ask us to erase it): your account, encrypted vault, sessions and activity log are erased immediately and any subscription is cancelled. Encrypted backups we keep for disaster recovery may hold an older encrypted copy until newer backups replace it (a rolling set kept for a few weeks). They stay encrypted.
- Administrator log: when we delete an account, switch it off or change its plan, we keep a short log entry with the date, which administrator acted, and the account's email in masked form (for example a***@example.com). It lets us audit what was done, and it does not contain your vault or activity.
- Sign-up codes are kept for ten minutes and removed when used or expired.

YOUR CHOICES AND RIGHTS
- Access and portability: export your whole vault at any time (CSV, or an encrypted backup).
- Correction: change your master password, profile and settings in the app.
- Deletion: delete your account in Settings. We cannot recover it afterwards, and nobody can.
- Requests or questions about your data: write to support@grailvault.in. We answer within 30 days.
If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights to access, correct and erase your personal data, to nominate someone to act for you, and to complain to us first. If you are in the European Economic Area or the United Kingdom, you have the corresponding rights under the GDPR, including the right to complain to your data protection authority. We process data to provide the service you asked for, to keep it secure and to meet legal obligations.

SECURITY
Your vault is encrypted on your device. See https://www.grailvault.in/security/ for how it is protected and an honest list of what GrailVAULT does not protect against. No system is perfectly safe. If personal data is exposed, we will tell affected people and the authorities as the law requires.

CHILDREN
GrailVAULT is not meant for children under 18, and we do not knowingly collect their data.

CHANGES TO THIS POLICY
If we change this policy in a way that matters, we will update the date above and, for significant changes, tell you by email or in the app.

CONTACT
Genesys Research & AI Labs (GrailVAULT), support@grailvault.in, 63749 34589.