Legal

1. Data We Collect

We collect minimal data necessary for service operation:

• Authentication metadata (via Google Auth)
• Encrypted secret blobs (which we cannot decrypt)
• Usage metrics and billing information
• Error logs (anonymized)

2. How We Use Your Data

• To provide and maintain our service
• To process billing and payments
• To send important service updates
• To improve our product (via anonymized analytics)

3. Data Sharing

We never sell your data. We only share data with:

• Payment processors (Stripe) - only billing info
• Infrastructure providers (for hosting encrypted data)
• Law enforcement (only with valid legal orders, and only metadata)

4. Your Rights

You have the right to:

• Access your data at any time
• Export all your encrypted secrets
• Delete your account and all associated data
• Opt out of marketing communications

1. Acceptance of Terms

By using Lockbox, you agree to these terms. The service is provided "as is" without warranties of any kind.

2. User Responsibilities

You are responsible for:

• Keeping your Master Password secure - we cannot recover it
• Maintaining backups of critical data
• Complying with all applicable laws
• Not using the service for illegal activities

3. Acceptable Use

You may not:

• Use the service for illegal activities
• Attempt to breach our security
• Reverse engineer our encryption
• Abuse our API or infrastructure

Violations may result in immediate account termination.

4. Billing & Payments

• Free tier is free forever
• Pro tier is billed monthly or annually
• Refunds available within 30 days
• Prices may change with 30 days notice

5. Service Availability

We strive for 99.9% uptime but cannot guarantee it. We're not liable for:

• Service interruptions
• Data loss (maintain your own backups)
• Security breaches (though our encryption should protect you)

6. Termination

Either party may terminate at any time. Upon termination, you have 30 days to export your data before it's permanently deleted.

Encryption Standards

• AES-256-GCM for symmetric encryption
• RSA-4096 for asymmetric encryption
• Argon2id for password hashing
• TLS 1.3 for all network communication

Security Audits

Our codebase is regularly audited by third-party security firms. Latest audit: Q4 2024.

Responsible Disclosure

Found a security vulnerability? Email us at security@lockbox.dev. We offer bounties for valid discoveries.