Privacy Policy

Envokey, Inc. (“Envokey”, “we”, “our”) is a US-based company committed to protecting your privacy and your data. Envokey is a zero-knowledge platform for securely storing and sharing sensitive credentials—logins, authenticator (2FA) codes, secure notes, payment cards, identities, API keys, SSH keys, and documents. We built it so that we cannot read your secrets—not to track users, not to analyze behavior, and never to sell data.

This Privacy Policy explains what we collect, how our encryption limits what we can see, how we use the data we do have, and the rights available to you.

1. Zero-Knowledge Encryption: What We Cannot See

The secret contents of your items—passwords, 2FA (TOTP) seeds, card numbers, secure notes, private keys, and attached documents—are encrypted on your device before they are sent to Envokey. Encryption keys are derived from your Master Password and a device-held Secret Key, neither of which is ever sent to our servers. Our servers store and relay ciphertext they cannot decrypt.

When you share items with your team, encryption keys are exchanged between members' devices using public-key cryptography. Envokey distributes only encrypted (wrapped) keys and never holds the material needed to unwrap them.

To keep the product usable (search, browsing, organizing), a limited set of item metadata is stored unencrypted: item names, item type, associated platform/website URLs, usernames or labels, and tags. Treat anything you place in these fields as visible to Envokey; everything in an item's secret fields is not.

2. What Envokey Does (and Does Not) Collect

2.1 Data We Collect to Provide the Service

Account Information

• Email address
• Display name, and optionally a profile photo and department
• Company / organization information
• Role and access permissions

Vault Data

• Encrypted item contents (secrets we cannot read; see Section 1)
• Plaintext item metadata: names, item type, platform/URL, username or label, tags
• Encrypted (wrapped) keys and public keys used for sharing
• Encrypted file attachments

Security Events / Audit Logs

Based on admin configuration, we may log:

• Sign-ins and session activity
• Item creation, modification, and access
• Sharing and permission changes
• Access attempts and failures
• User and organization management actions
• Billing and data export events

Organization admins control whether device identifiers (such as IP addresses) and user agents are included in audit logs, and how long logs are retained.

Device & Technical Information

• Browser type and version, operating system, and device type (per session)
• IP address (for security and abuse prevention)
• Timestamp of requests
• Push notification tokens, if you enable notifications on the mobile app
• Error logs and performance data

This is used solely for app functionality, session management (you can review and revoke your active sessions), security, and fraud prevention.

2.2 Data Envokey Does Not Collect

Inside the Envokey apps, we do NOT collect:

• Behavioral analytics
• Interaction heatmaps
• Click tracking
• Keystroke monitoring
• Fingerprinting
• Marketing identifiers
• Advertising cookies
• Biometric data (biometric unlock happens entirely on your device)
• Personal data unrelated to your use of the service
• Any data from third-party services associated with the credentials you store

The Envokey apps do not use:

• Google Analytics
• Hotjar
• Segment
• Facebook Pixel
• LinkedIn Insight Tag
• TikTok Pixel
• Session replay tools
• Ad tracking or remarketing tools

We do not scrape, mine, or repurpose your data.

3. The Envokey Clients

Envokey is available as a web app, a browser extension (Chrome and Firefox), and a mobile app (iOS and Android). All clients follow the same zero-knowledge model: decryption happens locally, and your Master Password and keys stay on your devices.

• Browser extension. The extension reads page context only to offer autofill of logins, 2FA codes, and cards you choose to fill. It does not record your browsing history, and page content is never sent to Envokey. Data copied to your clipboard stays on your device.
• Mobile app. Biometric unlock (Face ID, fingerprint) is handled by your device's secure hardware; biometric data never leaves your device and is never sent to Envokey. If you enable push notifications, we store a push token and deliver alert titles and bodies through Apple/Google push services—notification payloads never contain your secrets.

4. How We Use Your Data

We use your information to:

1. Provide and secure the Envokey service
2. Store, sync, and share your encrypted items across your devices and team
3. Enforce access restrictions and organization roles
4. Maintain audit logs (as configured by admins)
5. Detect and prevent abuse or security incidents
6. Process payments (via Stripe)
7. Send security alerts and notifications you have enabled
8. Communicate with you about important updates

We never sell data.

We never use vault data for marketing or analytics.

We never use customer data to train AI systems.

5. Legal Basis for Processing (GDPR)

For EU users, Envokey relies on the following legal bases:

• Contractual necessity (providing the Envokey service)
• Legitimate interests (security, fraud prevention, audit logging)
• Compliance with legal obligations
• Consent, where explicitly required (e.g., marketing site cookies)

You may withdraw consent at any time where it applies.

6. Data Transfers (EU → US)

Envokey is a US-based service. If you access Envokey from the EU or UK, your data is transferred to the United States under:

• Standard Contractual Clauses (SCCs)
• Additional technical and organizational protections (client-side encryption, access controls, SOC-compliant hosting)

You may request a copy of the SCCs by contacting privacy@envokey.com

7. How Long We Keep Data

Envokey retains data only as long as necessary to provide the service.

Approximate retention:

• Account data → until account deletion
• Deleted items → recoverable for a short grace period, then permanently purged
• Deleted accounts → deactivated immediately, then permanently purged after a limited holding period
• Audit logs → retention configurable by admins, subject to plan limits
• Audit log exports → automatically deleted after a short period
• Backups → retained for a limited period and encrypted
• Billing records → maintained as required by law

Once data is no longer needed, it is deleted or anonymized.

8. Payment Processing

Payments are handled by Stripe, a PCI-DSS compliant provider.

Envokey does not store full payment card details for billing purposes.

9. AI, LLMs, and Automated Processing

• Envokey does not send customer data to any third-party AI or LLM provider
• Envokey does not train machine learning models using customer data
• Envokey does not use automated decision systems that materially impact users

If AI features are added in the future:

• They will be optional
• They will undergo separate privacy review
• They will never access or process secrets

10. Your Rights

Depending on your location (including EU/EEA, UK, and California), you may:

• Access your data
• Correct inaccurate information
• Delete your data
• Export your data
• Object to certain processing
• Restrict processing in specific situations

To delete your Envokey account, or to request deletion of some or all of your data without deleting your account, follow the steps at Account & Data Deletion. For other privacy requests, contact us at privacy@envokey.com

11. Subprocessors

Envokey uses a small number of third-party providers:

• Hosting & infrastructure — serving the app and storing encrypted data, including Cloudflare for edge delivery, security, and encrypted file storage
• Stripe — payment processing
• Resend — transactional and notification email delivery
• Apple and Google push services — delivering mobile notifications you have enabled
• Monitoring and error detection

Identity and authentication are handled by infrastructure we host and operate ourselves—your login credentials are not processed by a third-party identity service.

These providers may process account metadata but never have access to your secrets, which remain encrypted with keys we do not possess.

A detailed DPA is available upon request.

12. Children's Privacy

Envokey is not intended for use by individuals under 16. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy as the service evolves. If changes are material, we will notify you through the app or by email.

14. Contact Us

For privacy questions or data requests:

privacy@envokey.com

Envokey, Inc.