Privacy Policy

Walilock is a zero-knowledge password manager. That is not a marketing phrase — it is an architectural constraint that shapes this entire policy. Your vault is encrypted on your own device using keys derived from a master password that never leaves your hardware. We store only opaque ciphertext. As a result, we literally cannot read your passwords, secure notes, or attached files, and we cannot hand them to anyone else, because we do not possess the keys to decrypt them.

This document explains, in plain language, what limited information we do collect, why we need it, what we are technically incapable of seeing, and the rights you have over your data. It applies to the Walilock apps, the Walilock website, and the Walilock sync relay, all operated by Richdale Ventures LLC ("Walilock", "we", "us").

What we collect and why

We practice data minimization: we collect the least we need to run the service, bill it, and keep it secure. Specifically:

• Account email address. Used to identify your account, let you sign in, send transactional messages (receipts, security alerts, sync-device notifications), and recover access to your account — not your vault. We do not use your email for advertising.
• Authentication data via OPAQUE. Walilock authenticates you with the OPAQUE protocol, an asymmetric password-authenticated key exchange (aPAKE). In practice this means your sign-in password is never sent to our servers — not even as a hash. During registration your device computes an OPAQUE "envelope" that the server stores but cannot use to recover your password. At login, your device and the server run a cryptographic exchange that proves you know your password without ever revealing it. If our database were stolen, there is no password (and no usable password hash) in it to crack.
• Encrypted vault blobs. When you use sync, your device uploads your vault as authenticated ciphertext (XChaCha20-Poly1305). To us this is an opaque blob of random-looking bytes with no decryption key attached. We store and forward it between your devices; we cannot open it.
• Billing information, handled by Stripe. Paid plans are processed by Stripe, our payment processor. Card numbers are entered directly into Stripe and we never receive or store your full card details. We retain only what we need for accounting and support: your plan, subscription status, billing country, and Stripe's customer/transaction identifiers.
• Minimal operational logs. To keep the service reliable and secure we process limited technical metadata — timestamps, coarse request information, IP address at connection time, error diagnostics, and rate-limiting signals. These are used to detect abuse and debug problems, retained for a short period (see retention below), and are never used to profile you or sold.
• No third-party ad tracking. We do not embed advertising SDKs, sell your data to data brokers, or run cross-site behavioral ad networks. There is no "surveillance" business model here — you are the customer, not the product.

What we cannot see

Because encryption and key derivation happen entirely on your device, the following are mathematically out of our reach. This is the whole point of the product:

The trade-off is real and we want you to understand it: because we cannot decrypt your vault, we cannot recover it for you if you forget your master password. Save an emergency kit when you enable sync — it restores access after a lost or wiped device, though it cannot replace a forgotten password. You can read the full mechanics on our Security page.

Cookies and local storage

Our website sets no cookies. It uses a small number of browser storage entries to keep you signed in, complete checkout, and remember a couple of preferences. We do not use advertising or cross-site tracking cookies. The Walilock apps use device storage to hold your encrypted vault and settings locally. For the full breakdown and your choices, see our Cookie Policy.

What we count

We count how often a few things happen, so we can tell whether our website and features work. We count actions, not people: every count is a daily total, with nothing that identifies you, your device or your account.

• In our service. Our servers add one to a daily total when a share link is created, when a share link is opened, when a checkout starts and when a checkout completes. The checkout totals record the plan, and a started checkout also records whether it began from a shared item or from the share dialog. That detail is never stored with your account and never sent to our payment processor.
• In the Walilock apps. When the app shows you the Family offer under a share link, and when you select or dismiss it, the app adds one to a daily total with your plan type and which offer it was. If you answer "How did you hear about Walilock?", it adds one to the total for your answer. These counts are sent without your account, and we do not store the network address they come from. You can turn them off in Settings → Preferences → Send anonymous usage counts.
• On our public website pages: home, pricing, download, security, enterprise, docs, support, contact, the lookalike link checker and our legal pages, in every language, and the password risk check, which is in Japanese only. On the lookalike link checker only the visit is counted: the link you check never leaves your browser. We count visits with Vercel Web Analytics, from the company that hosts this website. Before anything is sent, your browser reduces the page address to its path and any utm_ campaign tag: nothing after a #, and no other parameter. Vercel records that address with the time, the website that referred you, an approximate location (country, region and city), and your device type, operating system and browser. It sets no cookies; to count a visitor once a day it uses a code made from your request, which it discards after 24 hours.
• Three kinds of click: a download button (which platform, and whether you arrived from a shared item), a plan button on the pricing page (which plan), and, on the password risk check, starting it, finishing it, its sign-up button and its share buttons (LINE or X). Your answers and your result are worked out in your browser and are never sent.
• Arrivals from a shared item. The "Get Walilock" links and QR code on a shared-item page lead to walilock.com/get (or its French and Japanese versions), so a visit there counts as coming from a share. Nothing records which share, who sent it, or who opened it.

Website analytics never runs on the shared-item page itself, or on any page whose address can carry something personal or secret: signing up, signing in, password reset, checkout confirmation and your account.

None of these counts is linked to your Walilock account, used for advertising, or sold.

The browser extension

The Walilock browser extension is the one part of Walilock that runs inside your browser, and it is deliberately the least capable part. It has no account, no server, and no network access of its own — it cannot send anything to us, or to anyone else, because it has nowhere to send it to.

It does not hold your vault. What the extension does is passkeys: when a site asks you to create or use one, the extension hands that request to the Walilock desktop app over a local channel on your own computer. Your vault is opened and decrypted by the desktop app, on your device, and only the answer to that one request comes back. It also offers a passkey on sites where you already have a saved login and no passkey yet — the next section says how it knows that, because it is the one thing the extension does without waiting to be asked. The extension requires the desktop app for exactly this reason: without it, there is nothing for the extension to read.

Filling a saved password. When you click the Walilock button in your browser's toolbar, the extension shows the logins you have saved for the site you are on and fills the one you pick. A web page cannot start this. There is no way for a site to ask the extension for a password, request the list of what you have saved, or trigger a fill — the only thing that begins it is your click on the toolbar button, and the extension refuses the request otherwise. Which logins match is decided by the desktop app, on your computer, from the site's domain; the password itself is read out of your vault by the app at the moment you choose it, passed straight into the form, and kept nowhere else. It is never written to browser storage, and it is not held by the part of the extension that draws the menu you clicked.

The phishing check. Where you have a saved login for a site, the extension asks the desktop app whether that exact address appears on Walilock's list of addresses reported as phishing, and warns you before you fill. It warns; it does not block, and it is not a general site scanner — a site you have no saved login for is never checked at all, because the question only exists to protect a credential you are about to use.

That list is downloaded, never queried, and the distinction is the whole point. Your computer fetches a signed copy of the list and checks addresses against it locally. We are never told which site you are on — there is no lookup, no request per site, and nothing for us to log even if we wanted to. The list is fetched by the desktop app, not by the extension, so the extension keeps no network access of any kind. If your computer has not yet downloaded a list, the extension says so rather than implying a site is fine: silence is not a clean bill of health, and it is not presented as one.

Two things, neither of them secret, are kept in browser storage:

• A session handle — a short-lived reference to your currently unlocked desktop session, so you are not asked to unlock again on every request. It is cleared when you close your browser and is never written to disk.
• Prompt preferences — when you dismiss an offer to save a passkey for a site, the extension remembers that on your device so the prompt stays dismissed for thirty days instead of reappearing on every visit.

No password, passkey, or vault content is ever placed in browser storage.

The extension asks for permission to run on all websites. That is a broad permission and it is worth saying plainly why it needs one: any website can ask your browser for a passkey, and there is no way to know in advance which ones will. The extension has to be present when that call happens or it cannot answer it, and present on whatever page you decide to fill a password into. Restricting it to a fixed list would require us to know which sites you hold accounts on — which is precisely what the rest of this policy exists to prevent. The extension does not read the content of the pages you visit. It does see their addresses, and it uses them in one way worth stating plainly rather than leaving you to discover: on each site you open, it asks the Walilock desktop app — on your own computer, over the same local channel — whether you already have a saved login or passkey for that site, so it can offer to set one up where that would help. Only the site's domain is used for that question: not the full address of the page, not its contents, and not what you do there. Dismiss an offer and it stops asking about that site for thirty days, which also means it stops asking the app. Nothing about any of this leaves your computer — the extension has no network access, retains nothing beyond the two items above, and transmits nothing.

How your data is shared

We do not sell your personal data, and we never will. We share data only with a short list of vetted subprocessors that are contractually bound to protect it and use it solely to provide the service on our behalf:

• Stripe — payment processing and subscription billing. Receives billing details you enter; we do not see your full card number.
• Hosting & sync relay infrastructure — our cloud hosting provider runs the servers that store and forward your encrypted vault blobs. They handle ciphertext only and hold no keys.
• Vercel hosts this website and counts visits to its public pages, as described in What we count.
• Transactional email provider — delivers account and security emails (receipts, sign-in and device alerts, password-reset links for your account). Not used for marketing you didn't ask for.

We may also disclose information if legally compelled (for example, a valid court order). If we ever receive such a request, we will provide only what we actually hold — and because your vault is encrypted with keys we don't have, we cannot produce your decrypted secrets no matter who asks. Where permitted by law, we will notify you of requests affecting your account. Finally, if Walilock is involved in a merger or acquisition, any transfer of data will remain subject to this policy or a successor with equivalent protections.

Data retention and deletion

We keep personal data only as long as we need it:

• Account data (email, plan, OPAQUE records) — retained while your account is active.
• Encrypted vault blobs — retained while you use sync, and removed after account deletion.
• Operational logs — retained for a short window (typically up to 90 days) for security and debugging, then rotated out.
• Billing records — retained as required by tax and accounting law, which may be several years, held largely by Stripe.

You can delete your account at any time. Today, account deletion is handled by contacting our support team at support@walilock.com (a self-service in-app deletion flow is on our roadmap). On deletion we remove your account record and encrypted vault blobs from active systems and instruct our subprocessors accordingly; residual copies in encrypted backups are purged on our standard backup-rotation cycle.

Your rights

Depending on where you live — including under the EU/UK GDPR and California's CCPA/CPRA — you have rights over your personal data. Walilock honors these rights for all users, wherever you are:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate or incomplete information, such as your email.
• Deletion — request erasure of your account and associated data.
• Portability — receive your data in a portable format; your vault can also be exported directly from the app at any time.
• Objection & restriction — object to or ask us to limit certain processing.
• Non-discrimination — we will never penalize you for exercising these rights.

To exercise any of these, email privacy@walilock.com. We will respond within the timeframe required by applicable law (generally within 30 days). We do not sell or "share" personal information for cross-context behavioral advertising, so there is nothing to opt out of on that front.

How we protect your data

Security is the product, so protection is built in rather than bolted on:

• End-to-end encryption — vault items are encrypted locally with XChaCha20-Poly1305 before they ever leave your device.
• OPAQUE authentication — your sign-in password is never transmitted or stored, defeating server-side credential theft.
• Encrypted transport — all traffic is protected with TLS 1.3 on top of the application-layer end-to-end encryption.
• Device-bound keys — vault keys live in the OS keychain / secure element where available and are never written to disk in the clear.

Full technical detail — the cryptographic specification and our threat model — lives on the Security page.

International data transfers

Walilock operates globally, and our infrastructure and subprocessors may process data in countries other than your own, including the United States. Where we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses. In practice, the sensitive part of your data — your vault — travels only as ciphertext, so it stays unreadable regardless of which jurisdiction the servers sit in.

Children's privacy

Walilock is not directed to children. We do not knowingly collect personal data from anyone under 16 (or under 13 where that is the applicable minimum age). If you believe a child has created an account, contact us at privacy@walilock.com and we will delete it.

Changes to this policy

We may update this Privacy Policy as the product and the law evolve. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or in-app. Continued use of Walilock after an update means you accept the revised policy. This policy works alongside our Terms of Service.

Contact us

Questions, requests, or concerns about your privacy? We read every message.