1. Who we are
Credly is a password manager operated by Verluk Technologies (“Credly”, “we”, “us”). This policy covers the Credly website at credly.verluk.com, the web app at app.credly.verluk.com, the Credly apps for iOS, Android, macOS, Windows and Linux, the browser extension, and the command-line client.
For the personal data described here we are the data controller. You can reach us about anything in this policy at support@credly.verluk.com.
2. What we can't see
Credly uses end-to-end, zero-knowledge encryption. When you create an account, your device derives an encryption key from your master password and a randomly generated Secret Key. Both stay on your devices; neither is ever sent to us.
Everything you store in your vault is encrypted with keys we never hold before it leaves your device. That covers usernames, passwords, passkeys, notes, card details, two-factor secrets, SSH keys, attachments, and the names of your vaults. Signing in uses the SRP protocol, so we can confirm you know your password without ever learning it.
A consequence you should know: we can't recover your vault for you. If you lose both your master password and your Recovery Kit, the encrypted data can't be opened, by you or by us.
3. What we collect
Account information
- Your email address, and a display name if you choose to add one.
- Cryptographic material that lets you sign in and unlock, none of which can be used to decrypt your vault on its own: your SRP verifier and salt, key-derivation settings, your public keys, and your private key in encrypted form.
- Account settings, such as whether two-factor authentication, travel mode, breach monitoring or emergency access is turned on.
- For each passkey you add: its public key and a usage counter, and, if you turn on passkey unlock, an encrypted copy of your unlock key and Secret Key that only that passkey can decrypt. We can't read it.
- How you found us, if you signed up through a tagged link: the campaign source, medium and name (for example “newsletter”), or the website that referred you.
Vault metadata
To sync your vault and show it quickly, a few facts about each item are stored unencrypted: the item's type (for example “login” or “card”), the website host used to fetch its icon (for example github.com), whether it is a favourite, archived or in the trash, its size, and when it was created or changed. The item's contents stay encrypted.
The names, colours and icons of your folders are also stored unencrypted, so avoid putting secrets in a folder name. Which items are in which folder is encrypted.
Devices, sessions and security activity
- For each signed-in device: a device name and type, the browser or app user agent, the IP address it last connected from, and the approximate location (country and city) that IP address maps to.
- An activity log of security-relevant events on your account (sign-ins, new devices, item changes, sharing and account changes), with the IP address and user agent involved. You can view it in the app.
- Records of failed sign-in attempts and rate-limit counters, used to stop password-guessing and abuse.
Locations are looked up on our own servers from an offline database. Your IP address is not sent to a third-party location service.
Payments
If you subscribe, our payment providers handle your card or mobile-money details; we never see or store them. We keep your plan, subscription status, the amount and currency charged, the billing period, and the provider's customer and subscription references. If you subscribe inside the iPhone or Android app, Apple or Google takes the payment under their own terms; we receive the purchase details the store signs (product, billing period, renewal status and the store's transaction reference) so we can unlock your plan, and you manage or cancel that subscription in the store.
Messages you send us
If you email support, we keep that correspondence so we can help you.
Error reports
When something breaks, the apps send a technical error report: what failed, where in the code, and basic device and browser details. In the web app, a sample of sessions is also recorded as a session replay to help us reproduce bugs. Replays mask all text and block all images and media, so they capture layout and clicks only, never what is on screen in your vault.
Website analytics
On our public website (credly.verluk.com, including the password generator and this page) we count visits with Umami, an open-source analytics tool that we run on our own servers. No outside analytics company receives this data. It sets no cookies and builds no profile of you. We record the page you visited, the site that referred you, any campaign tags in the link, your browser, operating system, device type, screen size, language and country, and a few anonymous interactions with our tools: switching generator modes, regenerating, copying, running a strength or breach check, and clicking to sign up. We never record the passwords themselves, or how strong they are. Your IP address and browser details are used to count unique visitors: they are turned into an identifier that changes over time, and the IP address itself is not stored. If your browser sends a Do Not Track or Global Privacy Control signal, no analytics are recorded.
The vault web app, the browser extension, the mobile and desktop apps and the command-line client have no analytics.
The password generator and strength checker
The free tools on our website (the password, passphrase and PIN generators and the password strength checker) run in your browser with no account. Generated passwords, passphrases and PINs, and any password you type into the strength checker, are never transmitted or stored by us, and they are never part of our analytics. If you use the strength checker's optional breach check, your browser sends only the first five characters of the password's SHA-1 hash to Have I Been Pwned's Pwned Passwords service and compares the result itself. We remember your light or dark theme choice in your browser's local storage.
4. How we use it, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide your account: sign-in, sync across devices, sharing, emergency access | Account information, vault metadata, encrypted vault data | Performing our contract with you |
| Keep your account secure: new-device and sign-in alerts, lockouts, abuse prevention | Devices, sessions, activity log, IP addresses | Legitimate interest in protecting you and the service; contract |
| Breach monitoring (you can turn it off) | Your email address | Legitimate interest in warning you about exposed accounts |
| Billing and tax records | Payment records | Contract; legal obligation |
| Service emails: verification, security alerts, receipts | Email address | Contract; legitimate interest |
| Understanding how people find and use our website, and which campaigns lead to signups | Website analytics, signup campaign tags | Legitimate interest in improving the website and our marketing |
| Fixing bugs and keeping the service running | Error reports, masked replays | Legitimate interest in a working, reliable service |
| Answering support requests | Your messages, account information | Contract; legitimate interest |
We don't use your data for advertising, we don't sell it, and we don't make automated decisions about you that have legal or similarly significant effects.
5. Who we share it with
We use a small number of service providers, each only for the job listed, under contracts that require them to protect your data:
| Provider | What they do | What they receive |
|---|---|---|
| Akamai Connected Cloud (Linode) | Hosts our servers and database in Frankfurt, Germany, including our website analytics | Everything we store, including encrypted vault data they can't read |
| Stripe, Paystack | Process payments | Your email, payment details you enter with them, the amount charged |
| Apple (App Store), Google (Google Play) | Process in-app subscriptions | A random account identifier that ties the purchase to your Credly account; your payment details stay with Apple or Google |
| Have I Been Pwned | Breach monitoring | Your email address, sent from our servers |
| Sentry | Error reporting | Error reports and masked session replays |
| Google Fonts | Serves the fonts used by our website and web app | Your IP address and browser details when the fonts load |
Some features talk to third parties directly from your device, and only when you use them:
- Password breach checks (in the app, and in the strength checker on our website) send only the first five characters of a SHA-1 hash of each password to Have I Been Pwned's Pwned Passwords service, and the match is done on your device. The password itself never leaves it.
- Email aliases: if you connect an alias provider (such as SimpleLogin, addy.io, Firefox Relay or DuckDuckGo), your request and its access token are passed to that provider to create the alias. We don't store the token.
We will disclose data to authorities only when the law requires it, and we will challenge requests we believe are overbroad. Because your vault is end-to-end encrypted, the most we could ever hand over is encrypted data and the account information described above. If Credly is ever sold or merged, this policy will continue to apply to your data, and we'll tell you before anything changes.
A small number of Credly staff can view account information (not vault contents) to provide support and keep the service secure. Every such access is logged.
6. International transfers
Our servers are in the European Union (Frankfurt, Germany). Some of our providers process data in other countries, including the United States. Where data leaves the EU or the UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses to protect it.
7. How long we keep it
- Your account and vault: for as long as you have an account.
- Items in the trash: permanently deleted 30 days after you trash them.
- Sessions: expire after at most one week of validity; expired sign-in challenges and verification codes are deleted automatically.
- API tokens: revoked automatically after 180 days without use.
- One-time share links: deleted once they expire or have been used.
- When you delete your account: your account, vaults, items, devices, sessions and activity log are deleted immediately. Any copies in database backups are overwritten as those backups rotate. We keep payment records for as long as tax and accounting law requires.
8. Your rights and choices
Depending on where you live (for example under the EU or UK GDPR), you have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent where we rely on it. Much of this you can do yourself in the app:
- Export your vault from Settings at any time.
- Delete your account from Settings. You'll confirm with your master password, and deletion takes effect immediately.
- Turn breach monitoring off, and review your devices and activity log, in Settings.
For anything else, email support@credly.verluk.com. We'll reply within 30 days, and we may ask you to prove you own the account first. You also have the right to complain to your local data-protection authority.
9. How we protect it
Beyond end-to-end encryption, we use TLS for every connection, encrypted connections to our database, hashed session and API tokens, rate limiting and account lockouts, optional two-factor authentication and passkeys, and re-confirmation of your master password for sensitive actions. No system is perfectly secure. If you find a vulnerability, please report it through our security.txt contact.
10. Cookies and local storage
We use one cookie: a session cookie that keeps you signed in to the web app. It's strictly necessary, so it doesn't need consent. The apps also keep preferences (theme, auto-lock timing, your last-used email) in your browser's local storage or your device's storage. We use no analytics, advertising or cross-site tracking cookies. Our website analytics are cookieless (see section 3). When you follow a link from our website into the web app, any campaign tags travel in the link and are kept in that browser tab's session storage until you sign up or close the tab.
11. Children
Credly isn't directed at children under 16, and we don't knowingly collect their personal data. If you think a child has given us personal data, contact us and we'll delete it.
12. Changes to this policy
If we make a material change, we'll email you or show a notice in the app before it takes effect, and we'll update the date at the top of this page.
13. Contact
Questions or requests about your privacy: support@credly.verluk.com.