Privacy policy

Last updated 4 November 2026

Who we are

Emerald Vault is a password manager made by Clockworke. Contact: hello@clockworke.com.

End-to-end encryption

Your passwords, usernames, notes, website addresses, one-time code keys, previous passwords and vault and folder names are encrypted on your device before they are sent to our server. They are encrypted with keys derived from your password, which never leaves your device and is never sent to us. We cannot read your vault, and neither can anyone who gains access to our server.

Shared vaults are encrypted with their own key, which is locked separately for each member so only members can open it.

Each login is stored as its own encrypted entry. This lets the server check what each member is allowed to do (add, update or delete) without reading anything: it can see that an entry was added, changed or deleted, when, and by which account, but not what it contains.

What we store

• Your account email, so you can sign in and so teammates can share vaults with you.
• Encrypted vault data and encrypted keys, which we cannot decrypt.
• A one-way proof of your password, used only to check sign-ins. It cannot be turned back into your password.
• Your public key, so others can share vaults with you.
• If you create a Recovery Kit: a second encrypted copy of your account key, which only your recovery key can open, plus a one-way check of that key.
• Vault membership: which accounts belong to which shared vaults, and what each may do there.
• Deleted logins stay in the vault's trash, still encrypted, for 30 days (with who deleted them and when), then are removed for good.
• If you turn on two-step sign-in: the secret your authenticator app uses, encrypted on our server (we need it to check your codes), and one-way hashes of your backup codes.
• Signed-in devices: for each sign-in, the type of browser and system (for example "Chrome on Windows"), whether it is the extension or the website, and when it was created and last used, so you can see and sign out your devices. We don't store IP addresses.
• Error reports: when something unexpected fails in the extension, the website or the server, a short error message and where it happened, the app version and the signed-in account. Email addresses and anything that looks like a key or password are blanked out first. Kept for 30 days and visible to your organisation's administrators.
• Pending invites: the email address of people invited before they create an account.
• Activity counts: how many times you signed in, and how many times Emerald Vault filled or saved a login for you, with the time you were last active. These are counts only; we never record which sites. Your organisation's administrators can see them.

What stays on your device

Settings such as auto-lock, autofill and your default vault, and an encrypted copy of your vaults for offline use. One-time codes are calculated on your device. To show the "running on this site" notice once per site, the extension keeps a list of sites you have visited as irreversible hashes, on your device only; it is never sent to us.

What we don't do

No third-party analytics, no tracking, no advertising. We do not sell or share your data. The extension only reads login and one-time code fields on the pages you visit, to offer saving and autofill, and never sends page content anywhere.

Two-factor QR codes

When a page looks like a two-factor setup page (it mentions an authenticator app and shows a square image), or when you click Scan, the extension takes a picture of the visible tab and reads the QR code on your device. The picture is never stored or sent. Only if you choose Save is the code's key added to your login, encrypted like everything else. On the website, a QR image you choose or paste is read the same way, in your browser.

Vault health and the breach check

Vault health (weak, reused and old passwords) is worked out on your device; nothing about it is sent to us. The breach check, on unless you turn it off in Settings, asks Have I Been Pwned (api.pwnedpasswords.com) whether your passwords appear in known data breaches. For each password only the first 5 characters of its SHA-1 fingerprint are sent; Have I Been Pwned answers with every fingerprint that starts with them, padded so the answer's size says nothing, and the match is made on your device. Your passwords, and their full fingerprints, never leave your device. The results are kept on your device, encrypted, and checked again each week.

Activity log

For each vault we keep a log of what happened and when: an item was added, edited, moved to the Trash, restored, moved, shared, exported or deleted; members and invitations; and your sign-ins, with the type of browser and system as listed under Signed-in devices. The log holds the kind of event, who did it, the vault, a random identifier for the item and the time; never an item's name, website, username or anything else inside it. Names are filled in on your device, from your own encrypted vaults. A vault's owner can see its log; your organisation's administrator can see events for the whole team, without item names. Events are deleted after one year.

Travel Mode

When you turn on Travel Mode we store when you turned it on, and which of your vaults you marked safe for travel. While it is on, our server stops sending your other vaults to any of your devices, and each device removes its copy. They stay on our server, encrypted as always, until you turn Travel Mode off.

Access requests and "Can fill, can't see"

When someone asks for one of your vaults we store who asked, the vault's id (never its name, which we can't read), the level and length they chose, and when it was asked, answered and ended. The email we send you names the person, not the vault. If you approve, your browser wraps the vault's key for them, the same way as inviting someone; at the end time we remove them and your app gives the vault a new key. "Can fill, can't see" is a guard in our apps, not encryption: the helper's device can open the vault to fill logins, and our apps don't show, copy or export those passwords to them.

Service providers

Our server runs on Vercel, and data is stored with Supabase: a Postgres database, plus file storage for files attached to Project Management tasks. Vault contents are encrypted on your device before they leave it, so neither provider can read them. Project Management data (tasks, comments and attached files) is not end-to-end encrypted: it is kept private to your team and hosted by these providers on our behalf. Emails (invitations, password resets and task notifications) are sent through your organisation's own mail server, which receives the recipient's email address and the message.

Deleting your data

Your organisation's Emerald Vault administrator can delete your account, which deletes your personal vault and your vault memberships. You can also ask us at hello@clockworke.com. Signing out removes your data from that device.

Forgotten password

We never have your password or your recovery key, so we cannot recover your vault for you. If you created a Recovery Kit, you can use its key to set a new password yourself. Without one, a forgotten password means the vault cannot be opened.

Importing and exporting

When you import a CSV file, it is read and encrypted in your browser. Its contents are never sent to us unencrypted. An export is created in your browser after you confirm your password and is saved straight to your computer as a plain-text file; it is never sent to us. Delete it when you no longer need it.

Changes

If this policy changes, we will update this page and the date above.