Privacy
Last updated 15 October 2026
The short version: your secrets are encrypted on your Mac, EnVault has no servers and no accounts, and the app cannot reach the network. We can’t read your vault and can’t reset your passphrase.
What EnVault stores
Your secrets are encrypted on your Mac with a key derived from your passphrase. They are written only to the vault folder you choose or, in iCloud mode, to your own private CloudKit database. If you ask EnVault to keep an env file in sync with a project folder, it writes that file there, readable only by your user account, and nowhere else.
Network access
The app is sandboxed without a network entitlement. Sync is done by macOS (iCloud Drive or CloudKit). Update checks are done by the Sparkle framework’s helper service, which fetches a signed update feed from GitHub and sends no personal data.
The command-line tool
When you run envault while the app is open, the two talk over a local macOS channel on your Mac; nothing goes over the network. The app hands the vault key to the command only after you approve in a Touch ID or password prompt. You can turn this off in Settings › Command Line.
envault contacts other services only when you ask it to, through their own command-line tools and your own logins: Vercel, Cloudflare and GitHub for deploy; Doppler and 1Password for import.
Licenses and purchases
License keys are checked offline against a public key built into the app. No activation server, no usage tracking. The key contains the name and email entered at purchase so you can recognise it, and is stored only on your Mac.
Purchases go through Polar, the merchant of record, which handles payment details, invoices and VAT under its own privacy policy. Our store keeps the name, email, order id and issued key so we can re-send or revoke a key after a refund. Refunded keys are listed by id, not by name or email, in later app versions so they stop working.
Analytics and crash reports
EnVault contains no analytics SDK. Crash reports go through Apple’s standard crash reporter, under your macOS settings; we see them only if you share them with Apple and Apple shares them with developers.