Privacy Policy

The short version

• We collect only what is needed to run your account and your vault: your email, name, password (or Google sign-in) and the secrets you save.
• Secret values are encrypted before they are stored. We never sell your data and never use it for advertising.
• By default Dotkeep encrypts on the server. You can turn on end-to-end encryption so values encrypted by your browser cannot be read from the stored ciphertext alone. Previously saved secrets remain server-encrypted until you run “Encrypt existing secrets,” including their history. Secrets in shared projects remain server-encrypted. The docs explain both, and their limits.
• You can export your data and delete your account at any time, from Settings.

What we collect

Account information

Your email address and display name. If you sign up with a password, we store a salted hash of it (scrypt), never the password itself. If you sign in with Google, we receive your Google email address and name, and nothing else from your Google account.

Vault content

The projects and secrets you create. Secret values are stored encrypted with AES-256-GCM. Names, environments, types and descriptions are stored as plain text so they can be listed and searched, which is why descriptions should never contain a secret. The last 20 previous values of each secret are kept encrypted so you can restore them. If you turn on end-to-end encryption, values are encrypted in your browser before they are sent, and we store only the ciphertext and a copy of your vault key that is locked by your passphrase and recovery key. We never receive the passphrase or the recovery key.

Activity and security records

An audit log of what happened to your secrets (created, viewed, edited, exported, deleted) and when. It never contains the values. For two-factor authentication we store an encrypted authenticator secret and hashed recovery codes.

Sessions

When you sign in we create a session and store a short device label such as “Chrome on Windows”, plus when it started. We do not store your IP address or your full browser string. Sessions expire after 7 days.

Cookies

Dotkeep sets one essential cookie that keeps you signed in. It is HTTP-only, so page scripts cannot read it. We do not use advertising or tracking cookies, and we do not run third-party analytics.

How we use it

• To provide the vault: storing, showing and sharing your secrets as you ask.
• To sign you in and keep your account secure, including rate limiting sign-in, reveal and export attempts.
• To send emails you need: verification, password reset and alerts when your password changes. We do not send marketing email.
• To keep the audit log that you see on the Activity page.

Sign in with Google

If you choose “Continue with Google”, Dotkeep asks for the openid, email and profile scopes. We use your email address to find or create your account and your name to fill in your display name. We do not read your Gmail, Drive, contacts, calendar or any other Google data, and we do not share Google user data with anyone.

Dotkeep’s use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements. You can revoke Dotkeep’s access at any time from your Google Account permissions page.

Who we share it with

We do not sell or rent your information. It is shared only in these cases:

• People you choose. When you share a project, its members can see that project’s secrets according to their role, and the activity in it.
• Service providers. Our database host and our email provider process data on our behalf, only to run Dotkeep.
• Legal requirements. If we are legally required to disclose information, we will do so only to the extent needed. Because values are encrypted, we hold them only in encrypted form.

Keeping and deleting data

We keep your data while your account exists. When you delete your account in Settings, your sessions, secrets, version history, projects and activity are removed, and your account last. This cannot be undone. Backups made by our infrastructure provider may hold the data for a short time before they expire.

Files you export from Dotkeep, including whole-vault backups, contain your secrets in plain text. Once downloaded, they are yours to protect.

How we protect it

Values are encrypted at rest, hidden by default and fetched only when you reveal or copy them. Access is scoped to the owner and to the members they invite. You can add two-factor authentication and require a code before values are shown. No system is perfectly secure, and we cannot guarantee absolute security, but we take care to reduce risk.

We run automated security tests ourselves, covering access control, cross-site request protection, sign-in limits and leaks of secret values. Dotkeep has not yet had an independent security review or penetration test, and we make no claim of security certification. Please weigh that when deciding what to store. If you find a vulnerability, email legal@dotkeep.com and we will respond and fix it.

If we learn of a breach affecting your data, we will tell you without undue delay.

Your choices

• Access and export. Download your vault from the Vault page at any time.
• Correction. Change your display name in Settings.
• Deletion. Delete your account in Settings.

Depending on where you live, you may have further rights over your personal data, such as objecting to processing or complaining to a data protection authority. To use any of them, write to us at legal@dotkeep.com.

Children

Dotkeep is built for developers and is not intended for anyone under 16. We do not knowingly collect information from children.

Changes to this policy

If we change this policy in a meaningful way, we will update the date at the top and, where the change matters to you, tell you by email or in the app before it takes effect.

Contact

Questions about privacy? Email legal@dotkeep.com.