Privacy policy

This policy explains how Dankore Software handles your personal data when you use Dankore Vault. Dankore Software is run by Adamu Muhammad in Iowa, United States. In this policy, "we", "us" and "our" mean Dankore Software. "You" means the person using Dankore Vault.

We are responsible for your personal data. You can reach us at [email protected]. Our postal address is available on request.

Please also read our terms of service.

1. What we cannot see

Your vault is locked (encrypted) on your own device before it reaches our server. It is locked with a key made from your master password. We never receive your master password. This means:

• We cannot read the items in your private vault.
• We cannot see or reset your master password.

The one exception: Family shared

On a Family plan, our system holds the key to your family's "Family shared" folder. We need it to add family members for you automatically. We do not look at these items. But if someone broke seriously into our systems, items in "Family shared" could be exposed. Private vaults could not be exposed this way.

2. What we keep on the website

When you use our website at https://vault.dankore.com, we keep:

• Your name and email address.
• Your website password, stored only as a one-way scrambled code (an Argon2 hash). We cannot turn it back into your password.
• Your two-step sign-in secret, stored encrypted, if you turn on two-step sign-in.
• Your recovery codes, stored only as one-way scrambled codes.
• Your signed-in devices: a description of the browser or device, its IP address, and when it was used.
• A security log of account events, such as sign-ins and changes to your account, with the IP address.
• Your subscription status, copied from Stripe, and your Stripe customer number.
• Family members' names and email addresses, if you pay for a Family plan and add them.
• Support messages you send us, and the email address they came from.
• Notes about in-person setup appointments, such as the date and place, if you book one.
• Short notes our staff write when we help you, such as "called about a new phone". They never contain passwords. They are deleted with your account, and you can ask to see them.

3. What we keep on the vault server

Our vault server at https://secure-vault.dankore.com keeps:

• Your locked vault. We cannot read it, except for "Family shared" as explained in section 1.
• The email address you use for your vault.
• Technical data that the vault software (Vaultwarden) records, such as your IP address, the type of device, and when you signed in.

4. In-person setup

When we help you in person, we may see your screen. You type your master password yourself. We never write it down and we never keep it.

5. Why we use your data

We use your data only for these reasons:

1. To provide the service you signed up for: your account, your vault, your family and your billing. The law calls this "performing a contract".
2. To keep the service safe, and to prevent fraud and abuse. The law calls this our "legitimate interests".
3. To keep legal and tax records, such as invoices. The law requires this.
4. To send you service emails, such as receipts, payment problems, security alerts and reminders before your vault is deleted. These are part of the service.

We do not send marketing emails unless you have said yes to them.

6. Who else handles your data

We use a small number of trusted companies to help run the service. They may only use your data to do this work for us.

• Stripe takes payments, makes invoices and works out sales tax. Stripe has its own privacy policy.
• Amazon Web Services sends our emails (Amazon SES) and stores our encrypted backups (Amazon S3, in the United States).
• Bitwarden push relay: if you turn on push notifications so your phone updates straight away, Bitwarden, Inc. receives a device number and a "sync now" signal. It never receives anything from your vault.

Our main server is our own, run by Dankore Software in the United States. Our error reports also stay on our own server. They are not sent to any other company.

We may also share data if the law requires it, for example because of a valid court order.

7. What we never do

• We never sell your personal data.
• We never share your data for advertising.
• We use no analytics, no advertising and no tracking.
• We load no scripts or fonts from other companies on our website.

8. Cookies

We use only two small cookies, and both are needed for the website to work:

1. A sign-in cookie, so the website remembers that you are signed in.
2. A security cookie, which protects your account from a kind of attack called "cross-site request forgery".

We set no optional cookies. That is why we do not show a cookie banner.

9. How long we keep your data

• Account details: until you delete your account.
• Signed-in device records: up to 30 days after the device was last used.
• Security log: 1 year.
• Support messages: 2 years.
• Backups: 35 days, then they are removed.
• Your vault: deleted 30 days after your plan ends.
• Invoices: kept by Stripe for as long as tax law requires, usually 7 years.

10. Your rights

You can ask us to:

• See the personal data we hold about you.
• Fix data that is wrong.
• Delete your data.
• Give you a copy of your data. You can export your vault yourself in the Bitwarden app. For your website data, just ask us.
• Stop using your data for a certain purpose, if you object to it.

Email your request to [email protected]. We will reply within 30 days. We may need to check that the request really comes from you.

You can also complain to a data protection regulator or consumer protection authority where you live.

California residents

If you live in California, you have the rights above under California law (the CCPA, as changed by the CPRA). We do not sell or share your personal information. We will not treat you differently for using your rights.

11. Children

Dankore Vault is not made for children under 13. A child under 13 can only use it when their parent or guardian adds them to a Family plan. The parent or guardian must supervise the child.

We do not knowingly collect data from children under 13 in any other way. If you think we have, email us at [email protected] and we will delete it.

12. How we keep your data safe

• Every connection to our website and vault server uses HTTPS (a secure, encrypted connection).
• Our backups are encrypted.
• You can turn on two-step sign-in. Our own admin accounts must use it.
• Only the people who need access to our systems have it.
• The vault admin panel cannot be reached from the internet.

If there is a data breach that affects you, we will tell you without undue delay, as the law requires.

13. Where your data is kept

Your data is stored in the United States. If you live outside the United States, your data will be sent to and kept in the United States.

14. Changes to this policy

We may update this policy from time to time. If we make an important change, we will email you before it applies. The date at the top shows when it was last updated.

15. Contact us

For any question about your privacy, email us at [email protected]. Our postal address is available on request.