Last updated: March 14, 2026
This Privacy Policy is issued by VNATCO LLC ("Company," "we," "our," or "us"), which operates the KeyHive password manager Service accessible at keyhive.app and associated applications. VNATCO LLC is the data controller for personal data processed in connection with your use of the Service.
For all privacy-related inquiries, contact us at privacy@keyhive.app.
KeyHive is built on a zero-knowledge architecture. We cannot see, access, decrypt, or recover your passwords, notes, TOTP codes, file attachments, or any other vault data. Your master password is never transmitted to our servers. All encryption and decryption occurs exclusively on your device using keys derived locally from your master password. This is a fundamental architectural property of the Service, not merely a policy commitment.
As a direct consequence of this architecture, in the event of a legal order compelling disclosure of your vault contents, we have no technical means to comply. We can only produce encrypted ciphertext that is computationally infeasible to decrypt without your master password.
What this means for you: If you lose your master password, your vault data is permanently and irrecoverably gone. No one at VNATCO LLC - not engineers, not support staff, not the founder - has any ability to help you recover it. This is by design. Additionally, because your vault likely contains passwords to your other accounts (email, banking, etc.), vault loss may result in loss of access to those accounts as well. You must back up your vault by exporting it regularly through the application, and you must store your master password securely outside of KeyHive itself. VNATCO LLC assumes no liability for vault loss, master password loss, or any downstream consequences thereof.
When you register for a cloud account, we collect:
Your vault contents - including passwords, usernames, notes, TOTP secrets, file attachments, folder structures, and all associated metadata - are encrypted on your device using AES-256-GCM before transmission. We store only the resulting encrypted ciphertext. We cannot read, interpret, or access this data in any meaningful way.
We collect limited technical data necessary to operate the Service securely:
If you subscribe to a paid plan, payment processing is handled entirely by Stripe, Inc. We do not collect, transmit, or store your credit card numbers, bank account details, or other sensitive payment credentials. We receive only non-sensitive billing metadata from Stripe (such as the last four digits of your card and billing address) for invoice and account management purposes. Stripe's processing of your payment data is governed by Stripe's Privacy Policy.
We use the information we collect for the following purposes:
We do not use your information for advertising, do not sell your information to third parties, and do not engage in behavioral profiling.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following legal bases apply to our processing of your personal data under the General Data Protection Regulation (GDPR) and applicable national data protection laws:
Your encrypted data is stored on servers with the following protections in place:
Even in the event of a complete server or database compromise, an attacker would obtain only encrypted ciphertext that is computationally infeasible to decrypt without your master password. Our zero-knowledge architecture means that a breach of our servers would expose only encrypted ciphertext, not your readable vault contents.
No method of transmission over the Internet and no method of electronic storage is 100% secure. We cannot guarantee absolute security of the Service or your data. Despite our zero-knowledge design and security measures, we cannot warrant that unauthorized third parties will never be able to defeat our security measures or that your data will never be accessed, disclosed, altered, or destroyed as a result of a security breach, hardware failure, software defect, human error, or any other cause. You use the Service at your own risk. In the event of a security incident, our liability is limited as set forth in the Terms of Service. If you become aware of any security vulnerability or incident related to the Service, please notify us promptly at privacy@keyhive.app.
Because KeyHive decrypts your vault data locally on your device, the security of your device and browser environment is your sole responsibility. We are not responsible for and bear no liability for any loss, disclosure, or theft of your master password, decrypted vault data, or session credentials resulting from: a compromised, infected, or malware-affected device or operating system; a compromised web browser or malicious browser extension; keyloggers, screen capture software, spyware, ransomware, trojans, viruses, or any other malicious software present on your device; unauthorized physical or remote access to your device; or any other threat originating within your local environment. VNATCO LLC has no visibility into, or control over, your device or browser environment, and has no ability to protect you from threats that exist on your own hardware or software. Maintaining a secure, malware-free device is entirely your responsibility.
We do not sell, rent, trade, or share your personal data with third parties for commercial purposes. We may disclose information only in the following limited circumstances:
Our servers are located in the United States. If you access the Service from the EEA, the United Kingdom, Switzerland, or other regions with data protection laws, your information may be transferred to and processed in the United States, which may have different data protection standards than your country of residence.
Where required by applicable law, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. You may request information about our transfer mechanisms by contacting us at privacy@keyhive.app.
Importantly, because all vault data is encrypted on your device before transmission, the practical privacy risk of international transfer of vault data is minimal regardless of the legal framework, as transferred data is encrypted ciphertext we cannot decrypt.
KeyHive offers a local-only mode where your encrypted vault is stored entirely on your device. In local-only mode, no vault data or account information is transmitted to or stored on our servers. No account registration is required. We collect no personal data from users operating in local-only mode, other than the technical minimum required by any app store platforms through which you downloaded the application (which is governed by those platforms' respective privacy policies).
The KeyHive web application uses only the following essential cookies and local storage, with no advertising or analytics tracking of any kind:
We do not use analytics cookies, advertising cookies, pixel trackers, or any third-party tracking technologies. We do not use Google Analytics or any similar analytics platform.
Regardless of your location, you have the following rights with respect to your data:
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the GDPR and applicable national law:
To exercise any of these rights, contact us at privacy@keyhive.app. We will respond within the timeframes required by applicable law (generally within 30 days). Please note that due to our zero-knowledge architecture, we cannot provide the contents of your encrypted vault, as we do not have access to it.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:
To submit a CCPA request, contact us at privacy@keyhive.app with the subject line "CCPA Request." We will verify your identity before processing your request. We do not require you to create an account to exercise your rights, and we will not charge a fee for reasonable requests.
Categories of personal information collected in the preceding 12 months: identifiers (email address, account name, IP address); commercial information (subscription and billing records); internet or network information (session data, device tokens). We do not collect sensitive personal information as defined under the CPRA beyond what is necessary to operate the Service.
The Service is intended exclusively for users who are 18 years of age or older. We do not knowingly collect, solicit, or process personal information from any person under the age of 18. If we become aware that we have inadvertently collected personal information from a person under 18 years of age, we will take immediate steps to delete that information from our systems. If you believe we may have collected information from or about a minor, please contact us immediately at privacy@keyhive.app.
Some browsers transmit "Do Not Track" signals to websites. We do not currently respond to such signals in a differentiated manner because we do not engage in cross-site tracking of any kind regardless of whether a Do Not Track signal is received.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will post updated versions on this page with a revised "Last updated" date. For material changes, we will provide additional notice via email or in-app notification prior to the change taking effect. Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not accept the updated policy, you must stop using the Service and may delete your account.
For any privacy-related questions, requests, or concerns, please contact VNATCO LLC at:
privacy@keyhive.app
VNATCO LLC
EEA, UK, and Swiss residents have the right to lodge a complaint with their applicable supervisory authority if they believe their data protection rights have not been adequately addressed by us. We encourage you to contact us first so we can attempt to resolve your concern directly.