Privacy Policy

Security audit log (cyber-security), abuse prevention, breach checking via k-Anonymity protocol, local settings (localStorage), on-device encryption and decryption.

Contact form, marketing emails (newsletter, promotional content — opt-in at registration), optional analytics in the future (currently none).

Cloud vault synchronisation, authentication (login, email verification, recovery key confirmation), subscriptions and billing, subscription notifications, Secure Send feature.

Accounting records of subscriptions (Croatian tax legislation), retention of data required by the NIS2 directive for Business plan customers in essential sectors.

AES-256-GCM for vault contents with a key derived from the master password via Argon2id (a memory-hard KDF resistant to GPU attacks). Keys are kept only in RAM (chrome.storage.session) and are cleared on restart.

The encrypted Škrinjar database is stored in chrome.storage.local on your device. Free users never have any additional storage outside the device.

If you opt into sync, the client encrypts the entire vault with your key before sending it to the server. The server stores only an encrypted blob (binary package) — it cannot read individual entries.

Škrinjar automatically locks after inactivity (configurable timeout). The alarms and idle permissions are used — exclusively local, with no network communication.

When creating a cloud account, a 128-bit recovery key is generated — exclusively on the client. The server stores only its SHA-256 hash. If you forget your master password, the recovery key is the only way to regain access — Geslar cannot recover it.

Importing from other managers (Bitwarden JSON, CSV) takes place locally. Exporting your vault and personal data (Right to data portability, Art. 20 GDPR) is available through Settings → Account → Export data.

The verification token (UUID) is SHA-256 hashed before being stored in the DB. The plaintext token exists only in the sent email and in the client's memory until it is clicked. The token is valid for 7 days (registration) / 1 hour (resend).

The "resend verification" endpoint always returns 200 OK, regardless of whether a user with that email exists. This prevents an attacker from determining which email addresses have a Geslar account via the API.

3 verification emails per hour per email address, 10 per IP address. Prevents DoS and spam.

Action type (e.g. login, plan upgrade, password change), timestamp, sanitised URL pattern (without IDs), your user_id, organization_id, slug of the feature requested.

IP addresses, user agent string, referer header, full URLs with IDs in the path, request body content, response content.

12 months for Free / Premium / Family. 24 months for Business plan (NIS2 minimum). Automatically deleted upon expiry. On account deletion, the audit log is anonymised (user_id pseudonymised) — security interest under Art. 17(3)(b) GDPR.

Access to the active tab only when the user triggers autofill — exclusively for entering a password or card into the focused input field.

Injecting a script into the active tab on user request, for detecting login fields and inserting data.

Copying a password, TOTP code or card number to the clipboard on user request.

Storage of the encrypted Škrinjar database and user settings locally on the device via chrome.storage.local. Data never leaves the device.

Periodic check for auto-locking Škrinjar after inactivity. Used exclusively locally — no network calls.

User inactivity detection (locked/idle/active state) for auto-locking Škrinjar. No activity data is collected.

Shared vaults are accessible only to members who have been assigned that vault, under the permission granted (view or edit). The organisation owner/administrator manages membership and permissions — but cannot read vault contents.

Administrators see: member list, assigned permissions, access-event metadata (audit). Administrators do NOT see: password contents, credentials or notes — content is E2E encrypted.

In shared vaults, access metadata (who, which resource, when) is logged for security and accountability. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) + performance of service contract. IP addresses are anonymised. Personal (single-user) context: no audit logging. Default retention 18 months; security records may be retained for a shorter period. Members have the right to access records about themselves (Art. 15 GDPR).

A removed member immediately loses access to all shared vaults; shared keys are automatically rotated with no possibility of subsequent retrieval. The member's personal vault remains untouched. Note: the 30-day export window applies to cancellation of the entire plan, not to removal of an individual member.

Permanent deletion within 30 days of the request. Security and audit records are pseudonymised (user_id replaced by a hash) — a permanent record is kept without personal identifiers. Local data on user devices remains under their own control.

All shared and business vault data is processed and stored within the EU/EEA. A DPA (Data Processing Agreement) with sub-processors is in place; available on request to business customers.

The encrypted vault blob is stored on the server while your account is active. Deleting the account through Settings → Account → Delete removes the vault immediately. Backups rotate and exit the system within 30 days.

A cancelled plan stays active until the end of the paid period. After expiry the account switches to Free — your vault keeps working locally, cloud synchronisation turns off, and the cloud copy of your data is kept for another 30 days for export or re-subscribing; it is then permanently deleted from the servers. The Shared vault is read-only during that window. Data on your devices stays untouched.

Stored in the browser (chrome.storage.local) until the user deletes them or clears browser data. Geslar does not delete them automatically.

12 months for Free / Premium / Family. 24 months for Business plan (NIS2 minimum). Automatic cleanup cron. Anonymised on account deletion (Art. 17(3)(b) — security interest).

Auth tokens for maintaining login sessions — TTL 30 days with rotation. Deleted on logout, password change, and after an inactivity period. Suspicious activity triggers immediate revocation.

Email verification: 7 days (registration), 1 hour (resend). Password reset: 1 hour. Automatically deleted after expiry or first use.

Delivery status of transactional emails (sent / delivered / bounced / complained) — 90 days. Used for detecting delivery issues. Message content is NOT stored, only metadata.

Invoices and proof of payment — 11 years pursuant to the Croatian Accounting Act (Article 9). Not subject to Right to Erasure while the tax period remains open (Art. 17(3)(b) — legal obligation).

The encrypted payload is stored on the server until the selected expiry (1–90 days) or until the view limit is reached, after which it is automatically and permanently deleted.

Name, email and message content are kept only until the inquiry is answered, after which they are deleted. They are not stored in a database.

No data is stored — the check takes place in real time via the k-Anonymity API.

General privacy questions, GDPR requests (access, erasure, objection), questions about data processors.

Responsible disclosure of security vulnerabilities. See also security.txt (RFC 9116).

Legal questions, DPA requests for B2B Business plan customers, vendor due diligence.

Customer support — functional questions, account issues, suggestions for improvement. Or use the contact form.