Privacy Policy: Obsidian Vault

Effective October 29, 2026. This policy covers Obsidian Vault, the password manager run by Integrators Resource at vault.obsidiansuite.net, with its web vault, browser extension, Windows app and Android and iPhone apps (together, “the service”). It explains what we keep, what we cannot see, and why.

The short version

Everything you put in your vault is encrypted on your own device, with keys made from your master password, before it is sent to us. We store it but cannot read it.
Your master password never leaves your device. We cannot recover or reset it.
To run your account we keep your email address, the name you give, your devices and when they sign in, and a record of security events. That is listed in full below.
It is all kept on our own servers in Minneapolis, Minnesota, in the United States.
No ads, no analytics, no tracking, and we never sell your information or share it for advertising.

What we cannot see

The contents of every item: names, usernames, passwords, websites, notes, card numbers, addresses, custom fields, authenticator secrets, passkeys and attached files, as well as the names of your folders, collections and groups. They reach us only as encrypted data. The keys to decrypt them are made on your device from your master password (Argon2id, then AES-256-GCM for each item), and we never have them. Items shared with you, or held by an organization, are encrypted to your own key in the same way.

Your master password itself is never sent. Your device sends a value derived from it that proves who you are; we store only a further one-way hash of that value.

What we keep, and why

Your account: your email address (your sign-in name, and where we send security notices), the name you give (optional), your language, your password hint if you save one (stored as you typed it, so that we can email it to you), whether your address is verified, and when the account was created and its master password last changed.
Key settings: the settings and random salt your devices need to make your keys from your master password, your public key, and your other keys in encrypted form only.
Your encrypted vault: the encrypted items, folders and attachments, with the dates they were created, changed or moved to the trash, and their size. Items in the trash are deleted for good after 30 days.
Two-step login: what you turned on (authenticator app, security keys, email codes, a recovery code), the authenticator secret and security-key public keys needed to check your codes, and a one-way hash of your recovery code.
Devices: for each browser, extension or app you sign in with: the name it gives itself (for example “Chrome on Windows”), its type, when it was added, when it was last seen and the network (IP) address it last connected from. You can see and remove them in Settings. Sign-in tokens are kept only as one-way hashes.
Security records: failed sign-in attempts by email address and network address (to stop password guessing; deleted after one day), and a record of security events such as sign-ins, master password and two-step login changes, plan changes and administrator actions, with the time, device type and network address. Security records, including each organization's event log, are deleted automatically 12 months after they were made.
Sharing, organizations and emergency access: who shared which item with which email address, organization names and members with their roles and status, the invitations you send or receive, the emergency contacts you name and the state of their requests. An organization's owners and admins can read its event log: which member added, changed, moved or deleted which item (by its identifier, not its contents), who joined and left, and policy changes, with the time, device type and network address.
Your plan and billing: your plan, its status, whether it is billed yearly or monthly, seats, and its trial and renewal dates. Payments are handled by Stripe, which receives your card or other payment details directly on its own payment page; they never reach us. To open that page we give Stripe your email address (for an organization, its billing email), the plan and our internal reference for your account or organization. We keep only the Stripe customer and subscription references and the billing email of an organization. Stripe sends payment receipts and invoices, and its own privacy policy applies to what it processes.
Emails we send you (verification and sign-in codes, new sign-in notices, security notices, invitations, sharing and emergency access notices) go through our own mail server.

Breach checks and website icons

Breach checks (the security dashboard): your device turns a password into a one-way hash and sends only its first 5 characters to us. We pass those 5 characters on to Have I Been Pwned's range service and return the list of matching hashes, and your device checks the list itself. So neither we nor Have I Been Pwned ever see a password or its full hash. The 5-character prefixes are never stored with your account; the answer for a prefix is cached for up to 24 hours, without who asked, so that repeat checks are faster. Like every request, the check appears in our server logs (below) with your network address; a 5-character prefix is shared by hundreds of different passwords and says nothing about yours.
Website icons: while “Show website icons” is on (it is on by default; turn it off in Settings), your device asks our server for the icon of the websites in your vault, and our server fetches it from that website. Icon requests carry no sign-in. Our server keeps each icon by website name, without who asked: it fetches it again after 7 days (after 24 hours for a website without an icon) and deletes an icon nobody has asked for in 30 days. Icon requests do reveal to our server the website names and your network address, the way any web request does, and they appear in our server logs (below). With the setting off, no website names are sent.

Where your data is kept

The service runs on servers that Integrators Resource owns and operates in Minneapolis, Minnesota, United States. Your account, your encrypted vault and our backups are stored in the United States; if you use the service from another country, your information is transferred to the United States.

Connections reach our servers through Cloudflare (Cloudflare Tunnel), which protects the service from attacks. Cloudflare decrypts and re-encrypts each connection on its way to us, so it handles what your devices send us while it is in transit. Your vault is already encrypted on your device by then, so Cloudflare cannot read it either.

Server logs

Like any website, our web servers and Cloudflare see your network address, the time, the address of each request (we never log the part after a “?”) and the name your browser or app gives itself. We use these logs only to run and protect the service, and keep them for up to 30 days. Cloudflare keeps its own records under its own privacy policy.

Backups

Once a day we back up the database and the stored attachments. Each backup is encrypted with a key that is kept away from our servers, and the vault contents in it are the same end-to-end encrypted data as in the service, which we cannot read. Backups are kept for 14 days and then deleted, so something you delete is gone from every backup about two weeks later.

What the apps keep on your device

The browser extension and the apps keep an encrypted copy of your vault so that it opens quickly and works offline, and your settings. While the vault is unlocked its keys are kept in memory. If you turn on a PIN, Windows Hello, fingerprint or face unlock, a key that opens your vault is kept protected by your device's own secure storage. If you turn on “Stay logged in” in the browser extension, the key that opens your vault is kept on your computer, sealed so that only the extension can read it, until you lock the vault or sign out. Copied passwords are cleared from the clipboard after the time you choose. The apps have no ads, analytics or crash reporting.

We do not sell, rent or share your personal information (including “sharing” for cross-context behavioural advertising, as California law uses the word), and we do not use it for advertising. We run the servers and the mail server ourselves, and use only these service providers: Cloudflare for the network, Stripe for payments and Have I Been Pwned for breach checks, each receiving only what is described above (Have I Been Pwned gets only 5-character prefixes, from our server, never your network address). We disclose information only if the law requires it; what we hold is described on this page, and we cannot decrypt your vault for anyone.

When an organization (a team or business) uses the service, the organization decides about the information its members keep in it, and we handle that information on its behalf.

Your choices and deleting your data

See and change your name, email address and hint in Settings, and see and sign out your devices there.
Export your vault at any time, encrypted or as a plain file.
Delete your account in Settings: your account, your personal vault, its attachments, your devices and your sign-ins are deleted at once, and from our backups within about two weeks. Deleting your account also cancels a paid plan at once. Items you put in an organization stay with the organization. Your own security records are deleted at once; an organization you belonged to keeps its event-log entries of what you did there, but without your account's internal number or network address. We keep only a record that the account was deleted (its internal number, the time and the network address of the request, and your email address if our staff deleted it at your request) for 12 months. Stripe keeps the payment records the law requires it to keep.

Your rights

Wherever you live, you can ask us:

Access: for a copy of the information about you that we hold, as listed on this page.
Correction: to correct it. You can change most of it yourself in Settings.
Deletion: to delete it. You can delete your account yourself in Settings, as described above.
Export: for your information in a form you can take elsewhere. You can export your vault yourself at any time; we will send the rest of your account information on request.

We do not sell or share personal information, so there is nothing to opt out of, and we will not treat you differently for using any of these rights. Where the GDPR or a similar law applies, you can also object to or ask us to restrict how we use your information, and complain to your data protection authority; we use your information to provide the service you signed up for, to keep it secure and prevent abuse, and to meet our legal obligations. To make a request, contact us as below from your account's email address, or tell us that address; we may ask you to confirm it before we act, and we answer within one month. A member of an organization can also ask the organization, which decides about the information its members keep in it.

Children

The service is not directed at children under 13. A child may use it as a member of a family organization set up by a parent or guardian.

Security

All connections use TLS. Your vault is encrypted on your device as described above, two-step login and new-device checks protect your account, and repeated failed sign-ins are blocked. The security of your vault still depends on your master password: choose a long one that you use nowhere else.

Changes to this policy

If we change this policy, we will update this page and its effective date. If a change affects what the service keeps or sends anywhere, we will also tell you by email before it takes effect.

Contact

Integrators Resource, 2210 4th Ave S, Minneapolis, MN 55404. Questions about this policy or your privacy: larstrom.com/#contact.