Privacy policy
Last updated 25 October 2026. Version française.
In short: we collect what it takes to run your vaults and bill for them, we cannot read what is in a vault, we do not sell anything or show advertising, and we delete what we no longer need on the schedule below.
Who is responsible
Bay Three Software Inc. ("Libreyard", "we"), of 11 Kensington St, Guelph, Ontario N1E 3P3, Canada, runs this site, the portal at app.libreyard.com and the vaults under libreyard.app, and is responsible for the personal data this page describes (its "controller", in the words of the GDPR).
Our privacy officer is Hugo Klepsch, at support@baythreesoftware.ca or by telephone at +1 905-749-4627.
This page says what personal data we handle and why. The security and privacy page says what we are technically able to see.
This site
No cookies, no analytics, no trackers, nothing loaded from other domains. The web server keeps no log of visits.
The portal
| What | Why |
|---|---|
| Your email address | To log you in and to write to you about your account and your vaults |
| Your password, as a scrypt hash | To log you in. We do not have the password itself |
| Your authenticator secret (encrypted) and recovery codes | Two-factor login |
| When you agreed to the terms of service | To know that you did |
| Each vault's name, state, dates and storage use | To run and bill the service |
| Each vault's admin token (encrypted) | So that the portal can show it to you |
| A Stripe customer and subscription reference | To know whether a subscription is paid |
| A log of logins, failed logins and actions on your account, with times and IP addresses | Security, and working out what happened when something goes wrong |
| The emails we send you. Once one is sent, only its address, subject and time are kept | To send them, retry when sending fails, and know what was sent |
| Stripe's notifications about your subscriptions | To keep each subscription's state in step with Stripe |
| Session cookies | To keep you logged in. No other cookies are set |
We do not receive or store your card number. Stripe does. Stripe also holds your billing address, which it uses to work out the sales tax on each payment; before you have given one, we pass Stripe the IP address you started a free trial from, for the same purpose.
Your vaults
A vault's data directory holds what Vaultwarden stores: the email addresses and names of its accounts, their encrypted vault items and attachments, Vaultwarden's own records of devices and logins, and the icons of the websites saved in it. We store it in order to run the vault. We cannot read vault contents, and we do not look at the rest except where running, repairing or securing the service requires it.
The icons give away which websites a vault holds logins for: the apps ask your vault for each site's icon by its address, and your vault fetches the icon from that site and keeps a copy named after it. The security page says how to turn this off.
Requests to your vault pass through our servers, which see IP addresses and times. We do not log requests. Vaultwarden itself logs each failed login with its IP address and the email address that was tried.
For the people you invite, we hold their data on your behalf: you decide who is invited and what is stored. Tell them where it is kept, and send them to this page.
What we do with it, and why we may
We use personal data to provide the service, to bill for it, to keep it secure, and to write to you about your account. We do not sell it or share it for advertising, we do not send marketing email, and we make no automated decisions about you.
Under the GDPR and the UK GDPR, our reasons are:
- the contract with you, for your account, your vaults, payments and the emails about them;
- our legal obligations, for invoices and tax records, and for answering lawful requests;
- our legitimate interest in keeping the service secure, for the logs and the backups.
Under Canadian law, we collect, use and disclose personal data only for these purposes, with your consent, which you give by creating an account and using the service, and you can withdraw it by closing your account.
Who else handles it
These companies process personal data for us, under contracts that bind them to protect it and to use it only for us. Stripe is also responsible in its own right for the payment data it holds; see Stripe's privacy policy.
| Who | What for | Where |
|---|---|---|
| Akamai Technologies (Linode), United States | The servers everything runs on, the storage that holds our backups, and copies of the servers' disks | Canada and the United States |
| Stripe, United States and Canada | Payments, sales tax, invoices, receipts and renewal reminders | The United States, and other countries where Stripe operates |
| Web Hosting Canada, Canada | Delivering the portal's email to you | Canada |
We disclose personal data to authorities only when the law requires it. What we could hand over is what we can see: account data, logs and encrypted vaults. Where the law allows, we tell you first.
If another company takes over the service, your data goes with it, under this policy, and we tell you by email beforehand.
Where it is kept
Your data is kept in Canada and the United States, and may be reached from there by the companies above and by courts and authorities under those countries' laws.
For data from the European Union, the European Commission recognises Canada as giving adequate protection. Transfers to the United States rely on the safeguards our providers offer, such as the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. The same applies to data from the United Kingdom and Switzerland under their own rules.
How long it is kept
- A vault's data: until 30 days after its subscription ends, or until you delete it sooner. Then the data directory is deleted and we tell you by email.
- A record of a deleted vault: its name and dates are kept, without its data, for as long as your account exists. The name cannot be registered again for 90 days.
- Your portal account: until you close it, which removes the account record. The log entries, records of sent email and backups listed below stay until they expire. An account that has had no vault and no login for a year is removed, and we tell you by email. An account whose email address was never confirmed is removed after 7 days.
- A vault you did not pay for: removed after 7 days.
- Data archives you ask for: removed a day after they are made.
- Payment records: kept by Stripe, and in our accounts, for as long as tax law requires, which in Canada is six years.
- The portal's log of logins and account actions: 90 days.
- A vault's log of failed logins: 14 days.
- The record of an email we sent (address, subject, time): 90 days after sending.
- Stripe's notifications: 30 days.
- Backups: deleted data remains in the backups for about two months, until the last weekly backup holding it expires. Copies of the servers' disks that Linode keeps are at most about two weeks old.
Keeping it safe
The security and privacy page describes how the service is protected. If a breach of our security safeguards creates a real risk of significant harm to you, we tell you, and report it to the Office of the Privacy Commissioner of Canada and to any other authority the law requires, as soon as we can.
Your rights
Wherever you live, you can:
- see and correct your account details, and download every vault's data, in the portal;
- delete a vault, or close your account, in the portal;
- ask us for a copy of the personal data we hold about you, to correct it, or to delete it;
- ask how we use it and who we have shared it with;
- withdraw your consent, by closing your account.
If the GDPR or the UK GDPR applies to you, you can also ask us to restrict or stop processing your data, object to processing based on our legitimate interest, and receive your data in a portable form: the vault download is that form. Residents of US states with privacy laws have the rights those laws give: we do not sell or share personal data, or use it for targeted advertising.
Write to support@baythreesoftware.ca. We answer within 30 days, and may first ask you to show that the data is yours. There is no charge.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information if you live in Quebec, or to the data protection authority of the country where you live.
Children
The service is not for children. Account holders must be adults (see the terms), and we do not knowingly hold an account for anyone under 16. A vault's owner decides who is invited to it, including members of their family.
Changes
If this policy changes in a way that matters, we tell account holders by email at least 30 days before it takes effect, and the date at the top of this page changes.
Contact
Hugo Klepsch, privacy officer
Bay Three Software Inc.
11 Kensington St, Guelph, Ontario N1E 3P3, Canada
Telephone +1 905-749-4627
support@baythreesoftware.ca