Privacy Policy

This Privacy Policy explains how Halfstack, the operator of Deadbolt (“Deadbolt,” “we”), collects, uses, and protects information when you use trydeadbolt.com (the “Service”). We aim to collect only what we need to run the Service well.

• Account data — name, email, and password (hashed), handled via our auth provider, Supabase.
• Billing data — subscription status and the last four digits / card brand of your payment method. Full card details are collected and stored by Stripe, not by us.
• Customer Data (vault contents) — the logins, secrets, notes, and other items you store. These are encrypted in your browser before they reach us, so we hold only ciphertext. We never receive your Master Password and cannot read, decrypt, or recover your vault contents.
• Usage & device data — log data, IP address, browser/device type, and product analytics (via Vercel Analytics) to understand and improve the Service.
• Support data — messages you send us at info@tryhalfstack.com.

• Provide, secure, and maintain the Service;
• Process payments and manage subscriptions;
• Respond to support requests and send service-related notices;
• Improve features, performance, and reliability;
• Detect, prevent, and address fraud or abuse, and comply with law.

Where applicable, we process personal data to perform our contract with you, for our legitimate interests (e.g., securing and improving the Service), to comply with legal obligations, and with your consent where required.

We don’t sell your personal data. We share it only with service providers that help us run the Service:

• Supabase — database & authentication;
• Stripe — payment processing;
• Resend — transactional email;
• Vercel — hosting & analytics.

We may also disclose information to comply with law or to protect rights, safety, and security.

We retain personal data while your account is active and as needed to provide the Service. After account closure we delete or anonymize data within 90 days, except where we must retain it for legal, tax, or security reasons.

Deadbolt is built on zero-knowledge, end-to-end encryption: your vault contents are encrypted in your browser with keys derived from your Master Password, which we never receive. We store only ciphertext and cannot decrypt your data — so even in the event of a breach of our systems, your vault contents are not readable without your Master Password.

In addition, we use industry-standard measures including encryption in transit, row-level access controls on our database, and least-privilege access. No method of transmission or storage is 100% secure, but we work to protect your information and review our practices regularly.

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact info@tryhalfstack.com. You can also access and update much of your data directly in your account settings.

We and our subprocessors may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

We use essential cookies to keep you signed in and to operate the Service, and limited analytics cookies to understand usage. We don’t use advertising or cross-site tracking cookies.

The Service isn’t directed to children under 16, and we don’t knowingly collect their data.

We may update this Policy from time to time. Material changes will be notified in-app or by email, and the “last updated” date above will change.

For privacy questions or requests, contact info@tryhalfstack.com.