Last updated: September 25, 2026

VaultMesh is a local-first password manager with desktop, Android, and browser extension clients. This policy explains how those clients handle information. VaultMesh does not require a VaultMesh account or operate a cloud vault service.

Information VaultMesh handles

VaultMesh handles information you choose to put in your vault, such as login credentials, passkeys, payment cards, identities, SSH credentials, notes, and other secrets. The vault is stored in encrypted form on your device. The application also stores local settings needed to operate, such as lock preferences and authorized device information.

The browser extension may process the address of a page, form structure, and information you choose to save or fill. It communicates with the VaultMesh desktop application through the browser's Native Messaging feature. The extension does not store the vault file or Vault Key in browser storage. It stores limited non-secret preferences and remembered item identifiers locally; sensitive responses and fill values are used temporarily for the requested action.

When information leaves a device

VaultMesh does not send your vault contents to a VaultMesh account or central vault server. Information can leave a device when you enable or use a feature that requires it:

• Websites: If you choose to fill a form, the values are placed on that website. The extension does not submit the form for you. What happens after you submit it is governed by the website's privacy practices.
• Email verification codes: If you configure an email account, the desktop application connects to your chosen email provider to read messages needed to find verification codes. Provider credentials are kept in the encrypted vault. Message content is processed temporarily and is not saved as an email archive by VaultMesh. Your email provider processes connection and account data under its own policy.
• Local network devices: If you explicitly pair VaultMesh devices, they can exchange encrypted vault changes over the local network. Device discovery and pairing require user action. VaultMesh does not provide internet-based synchronization or a central synchronization server.
• User-directed integrations: If you explicitly authorize an API request, SSH action, or another integration, the destination you select may receive the information needed for that action. The destination's own privacy practices apply.
• Software distribution and updates: Desktop update checks and installer downloads contact the configured release host. Browser extension distribution and updates use the relevant browser store. Those services may process ordinary request information, such as an IP address, under their own policies; vault contents are not part of update requests.

VaultMesh does not sell vault information or use it for advertising or behavioral tracking.

Storage and retention

Vault data remains on your device until you delete it or remove the application data. Deleting an item may first place it in a recoverable trash or history area; use the application's permanent-delete controls when you want to remove those local copies. Backups and copies you create, operating-system backups, and information already submitted to another service must be managed separately.

Temporary data used for filling, verification codes, clipboard operations, and authorization is cleared according to the feature's lock, expiry, cancellation, or session rules. The browser extension does not persist decrypted vault responses as browser settings.

Your choices

You can lock your vault, revoke a browser or device authorization, disable optional integrations, and delete local vault data. You can choose whether to configure email access or pair another device. Uninstalling a client removes its application-managed local data according to the operating system's uninstall behavior; separately created backups and external-service data may remain.

Security

VaultMesh encrypts the vault on the device and limits access to sensitive values through authorized operations. No software can guarantee absolute security. Keep your device, browser, operating system, and backups protected.