Privacy Policy

1. Overview & Core Philosophy

We designed ApiVault on the principle of data minimization and zero-knowledge privacy. We collect only the technical and operational metadata strictly necessary to operate the web dashboard, authenticate users, synchronize secrets with the CLI client, and power secure MCP server connections for AI coding assistants.

We do not sell, rent, monetize, or broker your personal information or stored secrets under any circumstances. By accessing or using the ApiVault platform — including the web dashboard (apivault.tech), the CLI (apivault), the remote MCP server (https://mcp.apivault.tech/mcp), and official Agent Skills — you agree to the practices described in this Privacy Policy.

2. Information We Collect

A. Account & Authentication Data

When you register for an account, we collect your email address, an optional display name, and cryptographic authentication credentials:

• Passwords: If you register with email/password, passwords are salted and hashed using strong adaptive hashing functions (bcrypt). Plaintext passwords are never stored or accessible to ApiVault.
• Passkeys & WebAuthn: If you configure FIDO2/WebAuthn biometric or hardware passkeys, we store public keys, credential IDs, authenticator transport types, and counter values. Biometric data (such as Touch ID or Windows Hello fingerprints) remains exclusively on your device hardware and is never transmitted to or received by our servers.
• Two-Step Verification (TOTP): If you enable authenticator app MFA, we store encrypted TOTP secret seeds and recovery verification states.
• OAuth Social Logins: If you authenticate via Google OAuth, we receive your public profile identifier, name, and email address in accordance with the permissions granted on Google's authorization prompt.

B. Vault Secrets & Encryption Payloads

ApiVault stores the API keys and secrets you save in your vault:

• Encrypted Secret Payloads: All secret values are encrypted with authenticated AES-256-GCM encryption before persistence in our database, accompanied by unique initialization vectors (IV), authentication tags, and key derivation salts.
• Zero-Knowledge Custom Vault Mode: When you select Custom Encryption Mode, decryption keys are derived on-the-fly using versioned key derivation. New and explicitly rotated custom vault keys use a unique salt with memory-hard scrypt; legacy custom vaults remain readable with their existing derivation until you rotate them. Your custom vault passphrase is never transmitted to, received by, or stored in our database.
• Metadata: We store unencrypted organization metadata provided by you, such as key labels, service names (e.g., Stripe, OpenAI), target environments (Production, Staging, Development), tags, notes, and creation/modification timestamps.

C. CLI & Terminal Sessions

When you connect via the official CLI (apivault login), we generate an ephemeral pairing token and issue a secure, scoped API token stored locally in your user home directory under ~/.apivault/token.json with restrictive file permissions. When injecting environment variables via apivault run, secrets are decrypted directly into child process memory and are never written to disk.

D. Model Context Protocol (MCP) & AI Agent Connections

When you connect third-party AI assistants (such as Cursor, Claude Desktop, Windsurf, or autonomous agents) to our remote MCP server via OAuth 2.1 PKCE:

• We record the client identity, requested and granted OAuth scopes (e.g. keys:read,keys:reveal, keys:write), creation dates, and last-used timestamps.
• By default, MCP tools (list_keys, get_key) provide masked string previews only (e.g. sk-•••••••abc) to protect credentials from unintended prompt logs.

E. Technical & Telemetry Data

We record standard web server logs, including IP addresses, browser and OS user-agent strings, HTTP request methods, error stack traces, and session timestamps. This data is used solely for rate limiting, session auditing, DDoS prevention, and diagnosing operational failures.

3. How We Use Your Information

We use collected information exclusively to:

• Provide, maintain, and monitor the ApiVault vault service, web dashboard, and MCP gateway
• Authenticate your identity, enforce MFA challenges, and manage authorized sessions
• Encrypt, decrypt, and synchronize secrets at your explicit command
• Enforce granular OAuth 2.1 scope permissions for connected AI agents
• Send critical security notifications, such as new device logins or password modifications
• Prevent abuse, brute-force attempts, unauthorized access, and security breaches

4. Subprocessors & Third-Party Service Providers

We share data only with trusted infrastructure providers bound by strict confidentiality and data protection agreements:

• Database Infrastructure: Managed cloud database hosting (TiDB Cloud MySQL) with encryption in transit (TLS) and encryption at rest.
• Application Hosting: Edge routing, static asset serving, and serverless compute platforms (Vercel).
• Identity Providers: Google Identity Services (when chosen by the user for sign-in).
• Vercel Integration: When a project owner or admin connects Vercel and links a Vercel project, ApiVault sends the decrypted values of that project's mapped secrets to Vercel as environment variables, at the user's request. Vercel then stores them under its own terms. ApiVault keeps an encrypted Vercel access token for the connection and a keyed hash of each synced value (never the value itself), and deletes the variables it created when the project is unlinked.
• Supabase Integration: When a project owner or admin connects a Supabase organization and links a Supabase project, ApiVault sends the decrypted values of the chosen environment's secrets to Supabase as Edge Function secrets, at the user's request. Supabase then stores them under its own terms. ApiVault keeps encrypted Supabase access and refresh tokens for the connection, the names of the secrets it created and a keyed hash of each synced value (never the value itself), and deletes the secrets it created when the project is unlinked.
• Cloudflare Integration: When a project owner or admin connects Cloudflare and links a Worker, ApiVault sends the decrypted values of the mapped environments' secrets to Cloudflare as Worker secrets and build variables, at the user's request. Cloudflare then stores them under its own terms. ApiVault keeps encrypted Cloudflare access and refresh tokens for the connection, the names and IDs of the approved Cloudflare accounts, the names of the entries it created and a keyed hash of each synced value (never the value itself), and deletes the entries it created when the Worker is unlinked.

5. Data Retention & Account Deletion

We retain your account profile and encrypted vault items for as long as your account remains active. You may delete individual secrets, revoke CLI/MCP authorizations, or permanently delete your entire account at any time in **Settings → General / Security**.

Upon account deletion, all associated vault records, Passkey credentials, MFA seeds, and active OAuth tokens are permanently purged from our primary database immediately. Operational backups are cycled and overwritten on a standard rolling schedule.

6. Your Privacy Rights (GDPR, CCPA & Global Controls)

Regardless of your jurisdiction, ApiVault provides complete self-service controls over your data:

• Right to Access & Portability: View all stored keys or export them via CLI/JSON at any time.
• Right to Rectification: Edit names, tags, notes, or secret values in the dashboard.
• Right to Erasure: Delete specific keys or terminate your account with immediate effect.
• Right to Revoke Consent: Disconnect any CLI session or MCP client from Settings in one click.

To exercise formal legal privacy requests or ask questions regarding our compliance, contact us at support@apivault.tech.

7. Cookies & Local Storage

ApiVault uses essential, first-party HTTP-only cookies to maintain secure authenticated sessions, prevent Cross-Site Request Forgery (CSRF), and remember interface preferences (such as light/dark mode). We do not use third-party tracking, advertising, or cross-site behavioral analytics cookies.

8. Children's Privacy

ApiVault is a developer productivity service not directed at individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a minor has created an account, please contact us immediately to facilitate data deletion.

9. Contact Us

For inquiries or assistance regarding this Privacy Policy, please reach out to our team at support@apivault.tech. For terms governing the use of our software and API services, please review our Terms of Service.