The agreement
By creating an account or using PulsVault, you agree to these terms. If you are accepting them on behalf of a company, family, or team, you confirm you have authority to bind that organization, and "you" means both you and it.
These terms work alongside our Privacy Policy and Cookie Policy. If you do not agree with them, please do not use the service.
Eligibility and accounts
You must be at least 13 years old to hold an account, and at least 18 to purchase a paid plan. A member under 18 may be added to a family or organization by an adult who takes responsibility for that account.
- Give accurate registration details and keep your email address current — it is how we reach you about security.
- One account per person. Do not share your credentials; use our sharing features instead, which are built for it.
- You are responsible for everything done through your account, except where we are at fault.
- Tell us promptly at security@pulsvault.com if you suspect unauthorised access.
Your keys, your responsibility
PulsVault is zero-knowledge. Your keys are generated and held on your device, and we store only encrypted forms of them. That is what makes a breach of our servers useless to an attacker, and it is the same property that makes lost keys final.
You agree to:
- Choose a strong, unique master password and never reuse it elsewhere.
- Store your Recovery Key somewhere safe and offline, before you need it.
- Keep exports safe — an export you decrypt is plaintext once it leaves the app.
- Review your trusted devices and active sessions periodically, and revoke ones you do not recognise.
Plans and billing
Our free plan is free, with no time limit and no card required. Paid plans are billed in advance on the cycle you pick — monthly or yearly — and renew automatically until you cancel. Prices are shown on the pricing page and exclude taxes unless stated.
- Cancelling — cancel any time from your billing settings. You keep the paid features until the end of the period you have already paid for.
- Upgrades and downgrades — take effect immediately, with the difference prorated against your next invoice.
- Failed payments — we retry and email you. If payment does not succeed, the plan ends.
- When a plan ends — whether a trial or a paid plan: your account is read-only for 14 days, so you can export your data, then it is locked. An account that stays locked for 90 days is deleted after a further 14-day countdown, unless you subscribe. We email you 30, 7 and 1 days before it is erased, and buying a plan at any point before then cancels the deletion. While locked, you can buy a plan or delete the account yourself; the owner of an organization deletes the organization, which closes every account in it.
- Price changes — we give at least 30 days' notice before a renewal at a new price, and you can cancel first.
- Refunds — outside a statutory cooling-off right, charges are non-refundable, but talk to us if something went wrong.
Acceptable use
Because we cannot read your vault, we police behaviour rather than content. You agree not to:
- Use PulsVault for anything unlawful, or to store material you have no right to hold.
- Attempt to breach, probe, or overload the service, or to bypass rate limits, plan limits, or authorization checks.
- Reverse-engineer the service except where that right cannot lawfully be excluded.
- Resell or white-label the service without a written agreement with us.
- Use automated access outside our documented APIs, or scrape the service.
- Send unsolicited invitations or use secure links to distribute spam or malware.
Good-faith security research is welcome. Report findings privately, do not access other people's data, and do not degrade the service for anyone else.
DevOps Secrets and API keys
Machine access uses API keys that carry an explicit authorization policy — which actions they permit, which paths they may touch, and which project they are pinned to. Keys are shown once, at creation, and we store only a hash. Treat them as production credentials:
- Scope each key to the narrowest policy that does the job, and give each pipeline its own.
- Never commit a key to a repository or paste it into a log; rotate immediately if you do.
- You are responsible for actions taken with a valid key, including by your CI systems.
- Revoking a key takes effect for new requests; rotate the underlying secrets too if you believe a key leaked.
Fair-use quotas apply to API traffic. We will contact you before restricting anything, unless the traffic is threatening the service for others.
Sharing and organizations
When you share a vault or an item, you re-wrap its key for the recipient on your device. Sharing grants an access level; the highest level assignable through sharing is Manager, and ownership never transfers by sharing alone.
- Revoking access stops future access and rotates the relevant key, but cannot retrieve what a recipient already read or copied.
- A secure link is usable by whoever holds the link, so send it over a channel you trust and set an expiry.
- Organization owners and administrators control membership, roles, and policy for their organization, and can remove members.
- Leaving or being removed from an organization ends access to that organization's shared vaults; your personal vault stays yours.
Availability and support
We work hard to keep PulsVault available, but we do not promise uninterrupted service on the free plan, and any service-level commitments for paid plans are those stated in your plan or order form. We schedule maintenance to minimise disruption and announce significant windows in advance.
Features may change. We add, improve, and occasionally retire functionality; where we retire something material, we give reasonable notice and, where practical, a migration path.
Your content
Your data is yours. We claim no ownership of it, and we grant ourselves only the narrow licence needed to store, transmit, and back up ciphertext so the service can function. That licence ends when you delete the data or close your account.
You can export your vault at any time. Because export decrypts on your device, an exported file is your responsibility from the moment it is written.
Our intellectual property
The PulsVault software, brand, and documentation belong to us and our licensors. These terms give you a limited, non-exclusive, non-transferable right to use the service while your account is in good standing — not a right to our code, marks, or design.
If you send us feedback or feature ideas, we may use them without obligation or payment. We appreciate them either way.
Suspension and termination
You may close your account at any time from your settings. We may suspend or terminate an account that breaches these terms, that we are legally required to act on, or that is being used in a way that endangers other users or the service.
Except where the law or an ongoing investigation prevents it, we give notice first and a chance to fix the problem. After termination we delete your data on the timeline set out in the Privacy Policy. Export anything you want to keep before you close an account.
Disclaimers
The service is provided "as is" and "as available". To the fullest extent the law allows, we disclaim implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
We do not warrant that the service will be error-free, that it will meet every requirement, or that stored data can be recovered if you lose your keys. Nothing here limits rights you have as a consumer that cannot lawfully be excluded.
Limitation of liability
To the extent permitted by law, neither party is liable for indirect, incidental, special, or consequential loss, or for lost profits, revenue, goodwill, or data, however caused.
Our total liability arising out of or relating to the service in any 12-month period is limited to the greater of the amount you paid us in that period, or 50 euro. These limits do not apply to liability for death or personal injury caused by negligence, for fraud, or to any other liability that cannot be limited by law.
Changes to these terms
We may update these terms as the product and the law evolve. For material changes we give at least 30 days' notice by email or in the console. Continuing to use PulsVault after a change takes effect means you accept the new terms; if you would rather not, you can cancel and export your data first.
Governing law
These terms are governed by the laws of the jurisdiction in which PulsVault is established, and the courts of that jurisdiction have non-exclusive jurisdiction over disputes. If you are a consumer, you keep the protection of the mandatory laws of your country of residence and may bring proceedings there.
If any provision is found unenforceable, the rest stays in force. Our not enforcing a provision is not a waiver of it.
Contact us
Questions about these terms: legal@pulsvault.com. For sales and plan questions, reach out to leads@pulsvault.com or use our sales form.