What Valt0 knows about you

Valt0 is made by BYTE 1620 SRL, a company registered in Romania (“Byte 1620”, “we”, “us”). We are responsible for the personal information this policy describes.

It covers the Valt0 command-line tool, the local service that runs beside it, the Valt0 app for Windows, the Node.js and Go clients, and this website.

For any question about privacy, or to use any of the rights set out below, write to hello@valt0.com.

Valt0 exists to hold secrets: passwords, API tokens, keys and anything else you put in a vault. Some of that may be personal information. Valt0 works with it only on your own computer, and only to do what you ask: create a vault, store or read a secret, or hand one to an app on the same machine.

It has no account and no sign-in, and it makes no network requests of its own. There is no telemetry, no usage statistics, no crash reporting and no update check.

Everything Valt0 stores is on your own disk:

• Vault files, wherever you create them, usually beside your code. Each one is encrypted and cannot be read without its key.
• Not the vault key. It is printed once, when the vault is created, and Valt0 keeps no copy of it.
• Its own working files, in a folder called .valt0 in your home folder.
• For deployment, a prime key printed to your terminal and an unlock key file written to the folder you are in. Where they go after that is up to you.
• Anything you ask it to copy to the clipboard. If your system keeps a clipboard history or syncs it between devices, that copy is in your system’s hands, not Valt0’s.

Valt0 never sends a vault anywhere, but you are meant to: a vault is made to be committed and pushed with your code. When you push it, it goes to your git host (GitHub or GitLab, say) under that service’s terms. It is still encrypted there, and unreadable to anyone without its key.

How you give a key to a teammate is up to you. Use a channel you trust, because whoever holds a vault and its key can read every secret in it.

The Windows app runs as a full-trust desktop app. Windows lets an app like that read any file your user account can read, so the Microsoft Store lists it as able to access personal information. Every app packaged this way carries the same label.

Valt0 uses that access for one thing: reading and writing its own files and the vaults you point it at.

Microsoft gives us reports on the Windows app: how many times it was acquired and installed, and in which countries, and, if it crashes or stops responding, how often, with technical details such as the Windows version, the kind of device and where in the program it failed. Windows collects this under Microsoft’s privacy statement and your diagnostic data settings. The reports do not tell us who you are.

Homebrew, GitHub, npm and the Go module proxy deliver Valt0 and its clients under their own privacy policies.

The install script and the downloads at dl.valt0.com come from our own server, which logs requests the same way this website does.

Microsoft Privacy Statement

This site sets no cookies, runs no analytics or advertising, and has no forms or accounts. The film on the home page is served from this site, not from a video platform.

Like almost every web server, ours records each request it answers: your IP address, the date and time, the page or file asked for, and what your browser says about itself. We keep these logs because we have a legitimate interest in keeping the site working and secure. We use them for nothing else, and delete them once they are no longer needed for that.

The site’s typefaces load from Google Fonts, so your browser connects to Google’s servers, which receive your IP address. Google’s privacy policy covers what happens there.

Google Privacy Policy

If you email hello@valt0.com, we use your address and what you write only to answer you, and keep the conversation for as long as that takes. Our email provider stores the messages for us. We will not add you to a mailing list.

We do not sell, rent or trade personal information, and we do not share it for advertising. The only others involved are the companies that run our web server and our email, which hold that data on our behalf. We disclose it to anyone else only when the law requires us to.

Almost everything Valt0 handles is on your own computer, so you control it directly. You can read, copy, move or delete your vault files and the .valt0 folder at any time. Uninstalling Valt0 removes the program, not your vaults: to remove everything, delete the vault files and the .valt0 folder yourself.

For what we do hold, the server logs and your emails, you can ask us to show you what we have, to correct or delete it, to restrict or object to how we use it, or to give you a copy to take elsewhere. Write to hello@valt0.com and we will answer within a month.

If you think we have mishandled your data, you can complain to Romania’s data protection authority (ANSPDCP) or to the one where you live.

ANSPDCP, the Romanian authority

If Valt0 ever starts sending anything off your computer, this page will say so before the version that does it is released. Every change is dated at the top of this page.