What Valt0 knows about you

Valt0 is made by BYTE 1620 SRL, a company registered in Romania ("Byte 1620", "we", "us"). We are responsible for the personal information this policy describes.

It covers the Valt0 command-line tool, the local service that runs beside it, the Valt0 app for Windows, the Valt0 client libraries, and this website.

For any question about privacy, or to use any of the rights set out below, write to hello@byte1620.com.

Valt0 exists to hold secrets: passwords, API tokens, keys and anything else you put in a vault. Some of that may be personal information. Valt0 works with it only on your own computer, and only to do what you ask: create a vault, store or read a secret, or hand one to an app on the same machine.

It has no account and no sign-in, and it makes no network requests of its own. There is no telemetry, no usage statistics, no crash reporting and no update check.

Everything Valt0 stores is on your own disk:

• Vault files, wherever you create them, usually beside your code. Each one is encrypted and cannot be read without its key.
• Not the vault key. It is printed once, when the vault is created, and Valt0 keeps no copy of it.
• Its own working files, in a folder called .valt0 in your home folder.
• For deployment, a prime key printed to your terminal and an unlock key file written to the folder you are in. Where they go after that is up to you.
• Anything you ask it to copy to the clipboard. If your system keeps a clipboard history or syncs it between devices, that copy is in your system's hands, not Valt0's.

Valt0 never sends a vault anywhere, but you are meant to: a vault is made to be committed and pushed with your code. When you push it, it goes to your git host (GitHub or GitLab, say) under that service's terms. It is still encrypted there, and unreadable to anyone without its key.

How you give a key to a teammate is up to you. Use a channel you trust, because whoever holds a vault and its key can read every secret in it.

The Windows app runs as a full-trust desktop app. Windows lets an app like that read any file your user account can read, so the Microsoft Store lists it as able to access personal information. Every app packaged this way carries the same label.

Valt0 uses that access for one thing: reading and writing its own files and the vaults you point it at.

Microsoft gives us reports on the Windows app: how many times it was acquired and installed, and in which countries, and, if it crashes or stops responding, how often, with technical details such as the Windows version, the kind of device and where in the program it failed. Windows collects this under Microsoft's privacy statement and your diagnostic data settings. The reports do not tell us who you are.

Homebrew, GitHub and the package registries the clients are installed from, such as npm, deliver Valt0 and its clients under their own privacy policies.

The install script and the downloads at dl.valt0.com come from our own server, which logs requests the same way this website does.

Where we publish a client ourselves, as with the Java client at maven.valt0.com, its files are stored with DigitalOcean and delivered through DigitalOcean's network, so when your build fetches them, DigitalOcean's servers receive your IP address the way any server does.

Microsoft Privacy Statement DigitalOcean Privacy Policy

This site sets no cookies of its own, runs no advertising, and has no forms or accounts.

The film on the home page is not on a video platform. It is stored with DigitalOcean and delivered from assets.valt0.com, and nothing is fetched from there until you press the button that opens it. Your browser then connects to DigitalOcean's servers, which receive your IP address the way any server does.

One article on the blog has a video from YouTube. Until you press play, the article shows a still image from this site and nothing is fetched from YouTube. When you press play, your browser loads YouTube's player from youtube-nocookie.com, the privacy-enhanced version Google offers for embedding, so Google receives your IP address, what your browser says about itself and what the player records while you watch, and YouTube may store cookies or similar data in your browser. Google's privacy policy covers what happens there.

To know which pages are read, the site counts visits with Umami, a service run for us by Umami Software. Each page you open sends Umami its address and title, the page you came from, your browser, operating system and kind of device, your screen size and language, and your country, which Umami works out from your IP address. It sets no cookies, and Umami says it stores nothing that identifies you, your IP address included. Umami's servers are in the United States and the European Union.

The same count covers a few things done on a page, each sent to Umami with the same details as a page view: copying an install command, a command or an example from the documentation; opening the film, and how much of it plays; pressing an Install, Docs or report button; and arriving at an address with no page behind it. Each is a short name and a word or two about it, such as which platform's install was copied or which address had no page. The site never reads your clipboard: when you copy something from it, it notes that a copy was made, not what the copy holds.

We use these counts because we have a legitimate interest in knowing which pages and instructions are useful, and for nothing else.

Like almost every web server, ours records each request it answers: your IP address, the date and time, the page or file asked for, and what your browser says about itself. We keep these logs because we have a legitimate interest in keeping the site working and secure. We use them for nothing else, and delete them once they are no longer needed for that.

The site's typefaces load from Google Fonts, so your browser connects to Google's servers, which receive your IP address. Google's privacy policy covers what happens there.

Google Privacy Policy DigitalOcean Privacy Policy Umami Privacy Policy

If you email hello@byte1620.com, we use your address and what you write only to answer you, and keep the conversation for as long as that takes. Our email provider stores the messages for us. We will not add you to a mailing list.

If you report a problem by opening an issue on GitHub, the issue is public: anyone can read it, along with your GitHub username. GitHub's privacy statement covers your account and what you post there. We use what you write only to answer you and to fix the problem.

GitHub Privacy Statement

We do not sell, rent or trade personal information, and we do not share it for advertising. The only others involved are the companies that run our web server, the storage the film and the Java client are delivered from, the service that counts visits, and our email, which hold that data on our behalf. If you play the video in the blog article, Google receives what YouTube's player collects under its own policy, not on our behalf. We disclose personal information to anyone else only when the law requires us to.

Almost everything Valt0 handles is on your own computer, so you control it directly. You can read, copy, move or delete your vault files and the .valt0 folder at any time. Uninstalling Valt0 removes the program, not your vaults: to remove everything, delete the vault files and the .valt0 folder yourself.

For what we do hold, the server logs and your emails, you can ask us to show you what we have, to correct or delete it, to restrict or object to how we use it, or to give you a copy to take elsewhere. Write to hello@byte1620.com and we will answer within a month.

If you think we have mishandled your data, you can complain to Romania's data protection authority (ANSPDCP) or to the one where you live.

ANSPDCP, the Romanian authority

If Valt0 ever starts sending anything off your computer, this page will say so before the version that does it is released. Every change is dated at the top of this page.