Cookie Guidelines

1. Zero-Tracking Commitment

We do not employ marketing, profiling, analytics, or third-party advertising cookies. We believe tracking tools have no place in a cryptographically isolated environment. We store zero traces of your browsing habits or IP geolocation structures.

2. Strictly Necessary Cookies

To enable vault synchronization, we require a single functional cookie to hold your cryptographic authorization session. This token is set as:

• HttpOnly (preventing local JavaScript reading or scripting access)
• Secure flag enabled (requiring HTTPS encryption lines)
• SameSite = Lax (preventing cross-origin token transmission)

3. Sandbox Local Cache

Your decrypted passwords and local Data Encryption Keys are never saved to cookies, LocalStorage, or physical hard disks. The browser caches this sensitive data solely within the transient, volatile memory block of SessionStorage. This is automatically cleared when your browser window closes or the security timer triggers a lock invariant.

4. Client Configurations

We store a single local setting value: your light/dark mode preference (lp-theme). This allows your display registers to default to your chosen color configuration on next visit. It holds no identifiable data.