Seven365 Vault: privacy policy

Effective 15 October 2026. Seven365 Vault is Seven365’s internal password manager, provided as a browser extension to Seven365 staff and people they invite.

The short version

Your passwords are encrypted on your device before anything is saved. Seven365 and our hosting provider cannot read them. Your master password never leaves your browser.

What is stored, and where

• Your email address, to create your account and let colleagues share folders with you.
• Encrypted vault data: your saved logins and shared folders, stored only as ciphertext. Names, websites, usernames, passwords, notes, one-time-code (2FA) secrets and passkeys (including their private keys) are all encrypted.
• Your public sharing key, so others can share folders with you. Your private key is stored only in encrypted form.
• Account records: your role (member, admin, owner), whether you may share, whether your account is active, and invitations you send or receive.
• A login secret derived from your master password. It is one-way: it can’t be turned back into your master password or used to decrypt your vault.

Data is stored with Google Firebase (Cloud Firestore and Cloud Functions in Singapore, asia-southeast1; Firebase Authentication). Google processes it on our behalf and may keep standard service logs, such as IP addresses. Invitation emails are sent from support@seven365.com.sg through Seven365's own mail server; they contain the invited address, the inviter's address and sign-up steps, nothing from anyone's vault.

What is not collected

• Your master password, or any password in readable form.
• Your browsing history. The extension runs on the pages you visit so it can spot sign-in fields, show its suggestion menu, fill a login you pick, and offer to save a login you just used. It compares page addresses with your saved logins inside your browser; addresses, page contents and what you type are never sent to us or anyone else. A login you choose to save is encrypted on your device like everything else.
• Analytics, advertising identifiers or tracking.

Your browser’s own password manager

If you turn on “Use instead of the browser’s password manager” in Settings, the extension asks for the browser’s privacy permission and uses it only to switch off the browser’s offer to save passwords. Turning the setting off gives that control back to the browser.

How it is used

Only to run the password manager: sign-in, syncing your encrypted vault between your devices, sharing folders with the people you choose, and letting admins manage access. Data is not sold, not used for advertising, and not shared with anyone except Google as our hosting provider. The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Retention and deletion

Your data is kept while your account exists. When someone leaves, an admin deactivates their account, which blocks access immediately. To have your account and data deleted, contact us. Encrypted data cannot be recovered without its master password; we cannot reset or recover it for you.

Contact

Seven365 Pte Ltd, Singapore: billy@seven365.com.sg