Privacy policy
Last updated 1 November 2026.
Your vault
Your logins are encrypted on your device with a key made from your master password. The server stores only the encrypted data. We cannot read your sites, usernames, passwords or notes, and we never receive your master password.
What we can read
To run your account, the server keeps these in readable form:
- Your email address and the date you signed up.
- Names of your signed-in devices, such as "Chrome on Windows".
- When each device and your account were last seen.
- The IP address of each login, kept for 90 days so we can warn you about new devices.
We send email only for your signup code and for alerts when a new device logs in. Email goes through Resend, which sees your address and the message.
No trackers
Lockbox has no ads, analytics or trackers, in the apps or on this site. We do not sell or share your data.
Logs and backups
Server logs never record what you send us and are deleted after 14 days. The database is backed up nightly and each backup is kept for 30 days.
Deleting your account
In the extension or the Android app, open Settings, choose Delete account and enter your master password. Your account, every saved login and all your devices are removed from the database right away. Copies in backups age out within 30 days.
Contact
Questions about privacy? Email privacy@allansimoyi.com.