Who we are
Passkey-X is operated by Vlightsoft Pvt Ltd ("Vlightsoft", "we", "us"). This policy covers passkey-x.com, the Passkey-X web app, desktop and mobile apps, browser extension and API.
For privacy questions or requests, write to support@vlightsoft.com.
The short version
- Your vault items (passwords, notes, cards, files and similar) are encrypted on your device before they are sent to us. We store only encrypted data and cannot decrypt it.
- Your vault password and recovery key never leave your device. We cannot reset them or recover your vault for you.
- We do not sell personal data, show ads, or use third-party tracking or advertising cookies.
- We collect the account, billing and security information needed to run the service, and nothing more.
Information we collect
- Account details: your email address, login password (stored only as a secure hash by our authentication provider), sign-in methods such as passkeys, authenticator apps or a mobile number you choose to add.
- Encrypted vault data: encrypted items, attachments, workspace keys and device public keys. These are unreadable to us.
- Workspace and organisation information: workspace and organisation membership, roles, invitations, policies and audit events. Workspace names and many labels are encrypted on your device.
- Billing information: plan, subscription status, seat count and invoices. Card details are collected and stored by Paddle, our payment reseller, not by us.
- Security and usage information: IP address, device and browser type, sign-in times, and security logs used to protect accounts, prevent abuse and troubleshoot problems.
- Messages you send us, such as support or sales requests.
- Links and messages you check for scams: for a link, its site address and path (never what follows “?”); for an email or text you choose to check, the sender's domain, the subject, the linked sites and a short excerpt with email addresses, numbers and links masked. The message text is not stored; the verdict is kept in a shared table so the same scam is recognised for everyone without checking it again. Reports you send about a wrong verdict, with your explanation, are kept for review.
- Sites you block or trust in Passkey-X, the scam websites and email senders you report (with your optional note), and unblock requests you send. Your organisation's administrators see reports and unblock requests made from your organisation account; the Passkey-X team sees reports and requests to review them.
- With the desktop app: the browser extensions and programs on the computer and the sites open in its browsers are checked on the computer. Only SHA-256 hashes (of extension ids, program names and site addresses, or a 4-byte part of them) are sent to check the Passkey-X threat database. Your organisation receives only problems found, such as the name and id of a harmful or not-allowed extension or program.
How we use information
We process personal data to perform our contract with you, to comply with law, for our legitimate interest in keeping the service secure, and with your consent where the law requires it.
- To create and secure your account, sync your encrypted vault and provide the features you use.
- To process payments, manage subscriptions and send receipts and service emails (for example sign-in, verification and security alerts).
- To detect and prevent fraud, abuse and security incidents, including automated bot checks at sign-in.
- To provide support and respond to your requests.
- To meet legal, tax and accounting obligations.
Service providers
We use trusted providers who process data on our behalf under contract:
- Supabase — database, authentication, file storage and server functions (data is currently hosted in Singapore).
- Netlify — website and app hosting and content delivery.
- Paddle.com — our reseller and merchant of record: checkout, payments, subscriptions, invoices and sales tax.
- Cloudflare Turnstile — bot protection on sign-in and sign-up forms.
- OpenAI — scam and phishing checks of links and messages that nobody has checked before, and of web addresses and email senders you report as scams (only the details listed above; never vault data or your note to the Passkey-X team).
- Email and SMS delivery providers — to send verification codes and service messages.
International transfers
Our providers may process data outside your country, including in Singapore, the United States and other locations. We rely on contractual and technical safeguards, and your vault contents remain end-to-end encrypted wherever they are stored.
How long we keep data
- Account and vault data: until you delete your account or remove the data.
- When you delete your account, your personal vault, devices, keys and encrypted files are erased. Any subscription for a workspace you own alone is cancelled.
- Organisation audit records may be kept for the period the organisation's plan or legal obligations require.
- Billing records: as long as tax and accounting laws require.
- Security logs: for a limited period, normally no longer than 12 months.
Your rights and choices
Depending on where you live (including under India's Digital Personal Data Protection Act, 2023 and the EU/UK GDPR), you may have the right to access, correct, export or erase your personal data, to withdraw consent, and to raise a grievance or complaint.
You can export your vault and delete your account at any time from Settings. For any other request, email support@vlightsoft.com; we respond within 30 days. If your account belongs to an organisation, some requests may be handled together with that organisation.
Security
We use client-side Argon2id and AES-256-GCM encryption, row-level access controls, optional two-step verification and passkeys, and a tamper-evident audit trail. No system is perfectly secure; please use a strong, unique vault password and keep your recovery key offline. Report vulnerabilities through our contact page.
Children
Passkey-X is not intended for children under 18 without the involvement of a parent or guardian, for example through a Family plan managed by an adult.
Changes to this policy
We will post any changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.
Contact and grievance officer
Vlightsoft Pvt Ltd, Grievance Officer — support@vlightsoft.com. We aim to acknowledge grievances within 48 hours and resolve them within 30 days.