Bitvaulter Terms of Service

DRAFT - for review by qualified legal counsel before publication. This is not legal advice.

Last updated: 2026-06-27 (date to be confirmed at publication)

These Terms of Service ("Terms") govern your access to and use of Bitvaulter, including the Bitvaulter software, applications, and any hosted service offered at bitvaulter.com (collectively, the "Service"), provided by [PLACEHOLDER: legal entity name] ("Bitvaulter," "we," "us," or "our"). Please read these Terms carefully. Section 4 (The Master Password) is especially important: it explains that we cannot reset or recover your master password, and that losing it means permanent and irreversible loss of access to your vault.

1. Acceptance of These Terms

By creating a Bitvaulter account, downloading or installing the Bitvaulter software, self-hosting the Service, or otherwise accessing or using any part of the Service, you agree to be bound by these Terms and by any policies referenced in them, including our Privacy Policy. If you do not agree to these Terms, do not access or use the Service.

If you are using the Service on behalf of a company, organization, or other legal entity, you represent that you have authority to bind that entity to these Terms, in which case "you" refers to that entity.

2. Eligibility and Age

You must be at least 18 years old, or the age of majority in your jurisdiction if that is older, to create an account or agree to these Terms on your own behalf. If you are between the minimum digital-consent age permitted by applicable law and the age of majority, you may use the Service only with the involvement and consent of a parent or legal guardian who agrees to these Terms on your behalf.

The Service is not directed to, and may not be used by, anyone under the minimum age permitted by applicable law. By using the Service you represent that you meet these requirements and that you are not barred from using the Service under the laws of any applicable jurisdiction.

3. Description of the Service

Bitvaulter is a zero-knowledge, end-to-end-encrypted password and secrets manager. Encryption and decryption happen on your device. The Service is designed so that the server stores only encrypted data and metadata, and so that we never receive your master password, your derived keys, or any plaintext content of your vault. For a detailed description of how this works, see our Privacy Policy and Security documentation.

Bitvaulter is available in two ways:

• Self-hosted. You may run the open-source Bitvaulter software on infrastructure you control, subject to the applicable license described in Section 7. When you self-host, you are the operator of your own deployment and are responsible for its configuration, security, availability, backups, and compliance with applicable law. Bitvaulter does not operate, monitor, or have access to your self-hosted instance.
• Hosted service (planned). A Bitvaulter-operated hosted option is planned but may not yet be generally available. When and where offered, the hosted service will run on a Supabase-compatible backend ("Mortarbase") consisting of a PostgreSQL database with Row-Level Security, JWT-based authentication, and S3-compatible object storage. Additional terms, pricing, and service-specific policies may apply to the hosted service and will be presented at the time it is made available.

We may add, change, or remove features of the Service over time. Some features are experimental or planned and may change before general availability.

4. The Master Password - Read This Carefully

This is the most important section of these Terms. Please read it in full.

Your vault is protected by a master password that only you know. Because Bitvaulter is a zero-knowledge service, your master password and the encryption keys derived from it never leave your device and are never sent to or stored by us in any recoverable form.

As a direct consequence:

• We cannot reset your master password. There is no "forgot password" recovery, no administrative override, and no back door.
• We cannot recover your master password or your data if you forget it. Neither Bitvaulter, nor the operator of any self-hosted instance, nor anyone else can decrypt your vault without your master password.
• If you lose or forget your master password, your vault is permanently and irreversibly lost. This includes all passwords, secrets, files, and other content stored in it. This is not a limitation we can lift; it is a fundamental property of how the encryption works and is the reason the Service can keep your data private even from us.

You are solely responsible for:

1. Choosing a strong master password and remembering it;
2. Keeping your master password confidential and not sharing it; and
3. Maintaining your own backups, including by using the encrypted local backup export feature (which is itself protected by a separate export password that you must also remember).

You accept full responsibility for any loss of data that results from a forgotten, lost, or compromised master password or export password. We strongly encourage you to store a backup of your master password in a secure, offline location and to keep current encrypted exports of your vault.

5. Account Responsibilities and Security

You are responsible for safeguarding your account and the devices on which you use the Service. This includes:

• Keeping your master password, export password, recovery materials, and any service-account or machine tokens secure and confidential;
• Using up-to-date, trustworthy devices and keeping the Bitvaulter software updated;
• Configuring available protections such as idle auto-lock and clipboard auto-clear in a manner appropriate to your risk; and
• Promptly notifying us at support@bitvaulter.com if you become aware of any unauthorized access to your account or any security vulnerability in the Service.

You are responsible for all activity that occurs under your account, to the extent permitted by applicable law. Because of the zero-knowledge design, we cannot see the content of your vault and therefore cannot help recover it or verify what it contained.

If you self-host, you are additionally responsible for the security, patching, access controls, and backups of your deployment and its underlying infrastructure.

6. Acceptable Use

You agree not to use the Service to:

• Store, transmit, or distribute content that is illegal under applicable law, or that you do not have the right to store or use;
• Store or use other people's credentials, secrets, or confidential information unlawfully or without proper authorization;
• Infringe the intellectual property, privacy, or other rights of any person;
• Engage in or facilitate fraud, phishing, malware distribution, or other malicious activity;
• Interfere with, disrupt, overload, or attempt to gain unauthorized access to the Service, its infrastructure, or other users' accounts or data;
• Circumvent or attempt to defeat the encryption, access controls, rate limits, or security measures of the Service except as expressly permitted; or
• Use the Service in violation of any applicable law, regulation, or third-party rights.

Because of the zero-knowledge design, we generally cannot see the content you store and do not monitor it. This does not relieve you of your obligation to comply with this Section. For any hosted service we operate, we may suspend or terminate access for violations of this Section as described in Section 13, based on the information available to us.

Responsible security research is welcome. If you discover a vulnerability, please report it to support@bitvaulter.com rather than exploiting it, and give us a reasonable opportunity to respond. A formal third-party security audit and penetration test are planned but have not yet been completed (see Section 9).

7. Licensing and Open Source

Bitvaulter has an open-source core and separately licensed commercial features:

• Open-source core. The Bitvaulter open-source core is licensed under the GNU Affero General Public License, version 3.0 (AGPL-3.0). Your use, modification, and distribution of the open-source core - including when you self-host - are governed by the terms of that license. The AGPL-3.0 prevails over these Terms with respect to your rights in the open-source software itself.
• Commercial and organization features. Certain commercial, enterprise, and organization-oriented features are provided under a separate commercial license and are not covered by the AGPL-3.0.

The authoritative licensing terms, including which components fall under which license, are set out in the project's LICENSE and LICENSING.md files. In the event of any conflict between this summary and those files, the LICENSE and LICENSING.md files control with respect to the licensed software.

Nothing in these Terms is intended to limit or replace any rights you have under the AGPL-3.0.

8. Intellectual Property

Except for the rights expressly granted under the open-source license described in Section 7, and except for content you store in your vault, all rights, title, and interest in and to the Service - including the Bitvaulter name, logo, branding, the commercial features, and the documentation - are and remain the property of Bitvaulter or its licensors. These Terms do not grant you any right to use Bitvaulter's trademarks, logos, or brand features without our prior written permission.

You retain all rights in the content you store in your vault. You are responsible for ensuring you have the rights necessary to store and use that content.

9. Service Availability and "As Is" Disclaimer

We work to make the Service reliable, but we do not guarantee that it will be uninterrupted, error-free, or available at all times. Features may be modified, suspended, or discontinued, and planned features (including the hosted service and Argon2id as a future key-derivation function) may change or may not be released. The current key-derivation function is PBKDF2; RSA-OAEP-SHA1 is retained for compatibility reasons. A third-party security audit and penetration test are planned before general availability and have not yet been completed.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL MEET YOUR REQUIREMENTS, THAT IT WILL BE SECURE OR FREE FROM BUGS OR VULNERABILITIES, OR THAT ANY DATA WILL BE PRESERVED OR RECOVERABLE.

No advice or information, whether oral or written, obtained from us or through the Service creates any warranty not expressly stated in these Terms. Some jurisdictions do not allow the exclusion of certain warranties, so some of the above exclusions may not apply to you.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

• We will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of data, loss of profits, loss of goodwill, or loss of business, arising out of or relating to the Service or these Terms, even if we have been advised of the possibility of such damages.
• In particular, and without limiting Section 4, we will not be liable for any loss of data resulting from a forgotten, lost, or compromised master password or export password.
• Our total aggregate liability arising out of or relating to the Service or these Terms will not exceed [PLACEHOLDER: liability cap - e.g., the greater of amounts you paid us for the hosted service in the 12 months before the claim, or USD $[PLACEHOLDER]].

These limitations apply to all claims, whether based in contract, tort, statute, or otherwise. Some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the above limitations may not apply to you; in that case, our liability is limited to the maximum extent permitted by law.

11. Indemnification

To the maximum extent permitted by applicable law, you agree to indemnify, defend, and hold harmless Bitvaulter and its officers, directors, employees, contractors, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or related to: (a) your use of the Service; (b) the content you store, transmit, or share through the Service; (c) your violation of these Terms or any applicable law; or (d) your infringement of any third-party right. We reserve the right to assume the exclusive defense and control of any matter subject to indemnification by you, in which case you agree to cooperate with our defense.

12. Suspension and Termination

You may stop using the Service at any time. You may delete an item, which removes its corresponding row, or delete your account, which cascades to and removes your profile, your items, and your stored files.

For any hosted service we operate, we may suspend or terminate your access, with or without notice, if we reasonably believe you have violated these Terms (including Section 6), if required by law, or if necessary to protect the Service or other users. Where practicable and lawful, we will provide notice.

Termination does not relieve you of obligations that by their nature should survive, including Sections 4, 7, 8, 9, 10, 11, 14, and 15. Self-hosted deployments are operated by you; ending your relationship with us does not affect your rights under the open-source license described in Section 7.

13. Export Controls and Sanctions

The Service includes cryptographic functionality and may be subject to export-control and economic-sanctions laws and regulations. You agree to comply with all applicable export, re-export, and sanctions laws. You represent that you are not located in, and are not a national of or ordinarily resident in, any country or territory subject to comprehensive sanctions, and that you are not listed on any government list of prohibited or restricted parties. You agree not to use, export, or re-export the Service in violation of any such laws.

14. Governing Law and Dispute Resolution

These Terms and any dispute arising out of or relating to them or the Service are governed by [PLACEHOLDER: governing law jurisdiction], without regard to its conflict-of-laws principles.

[PLACEHOLDER: dispute resolution mechanism - e.g., exclusive jurisdiction and venue of the courts located in [PLACEHOLDER], and/or a binding arbitration clause, class-action waiver, and informal dispute-resolution / notice period, as advised by counsel and consistent with applicable consumer-protection law.]

Nothing in this Section limits any non-waivable rights you may have under the mandatory laws of your place of residence.

15. Changes to These Terms

We may update these Terms from time to time. When we make material changes, we will update the "Last updated" date above and, for any hosted service, take reasonable steps to notify you. Changes are effective when posted unless stated otherwise. Your continued use of the Service after changes take effect constitutes your acceptance of the revised Terms. If you do not agree to the updated Terms, you must stop using the Service.

16. Miscellaneous

• Entire agreement. These Terms, together with the Privacy Policy and any service-specific terms and the licensing files referenced in Section 7, constitute the entire agreement between you and us regarding the Service.
• Severability. If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect.
• No waiver. Our failure to enforce any provision is not a waiver of our right to do so later.
• Assignment. You may not assign these Terms without our prior written consent; we may assign them in connection with a merger, acquisition, or sale of assets.

17. Contact

Questions about these Terms can be directed to:

• General, privacy, and security inquiries: support@bitvaulter.com
• Legal entity: [PLACEHOLDER: legal entity name]
• Postal address: [PLACEHOLDER: postal address]

DRAFT - for review by qualified legal counsel before publication. This is not legal advice.