Terms of Service

Version 2.9 · Effective: 10 June 2026. Please read these terms before using Geslar services.

Last updated: June 10, 2026

1. Acceptance of Terms

By using any Geslar service (the geslar.app web application, the Geslar Škrinjar browser extension, the Geslar Ključar mobile application, or the API) you accept these Terms of Service in full.

The service is provided by Geslar d.o.o., a limited liability company registered in the Republic of Croatia (hereinafter: Geslar, we, or us). Contact: [email protected]. If you do not accept these terms, please stop using Geslar services.

2. Description of Service

Geslar is a suite of applications for managing passwords and authentication codes. The service is available as a free and a Premium plan.

🔒

Free Plan

Local storage of passwords, TOTP codes, and notes with AES-256-GCM encryption. Available without registration, with no time limit.

☁️

Premium Plan

Encrypted vault synchronisation across devices via the cloud. Activated upon purchase of a Premium subscription through a trusted payment processor.

👪

Family plan

Sharing for up to 5 members — a Shared vault and a private vault per member, managed via Škrinjar on the web (my.geslar.app). Activated by purchasing a Family subscription.

Geslar services are provided on an "as-is" basis. We strive for high availability but do not guarantee uninterrupted service. We reserve the right to temporarily suspend the service for maintenance, with prior notice where possible.

3. User Account and Security

To use synchronisation (Premium) you must create a user account. By accepting these terms you confirm that:

The details provided at registration (email address) are accurate and up to date.
You are at least 16 years old, or have parental/guardian consent if you are younger.
Your account is used only by you — access by third parties is not permitted without explicit authorisation.
You will notify us immediately of any unauthorised access to your account at [email protected].

Family plan (Shared vault). The family plan organiser confirms they are of legal age and, for minor members, holds parental responsibility and provides the consent under Art. 8 GDPR. The organiser is responsible for use of the plan by members they add and manages membership and the Shared vault via Škrinjar on the web (my.geslar.app). The right of unilateral withdrawal within 14 days (Consumer Protection Act) applies in accordance with the Refund Policy.

3a. Family plan and Shared vault

The Family plan lets you share selected entries within a family while keeping each member's privacy.

Up to 5 members per plan.
Shared vault for common entries, plus a private vault per member that others cannot see.
Sharing is end-to-end encrypted (per-member key) — Geslar cannot see the contents.
The organiser manages members, permissions and billing via Škrinjar on the web (my.geslar.app) and is responsible for the plan; for minor members they provide consent under Art. 8 GDPR.
Removing a member ends access to the Shared vault immediately. A cancelled plan stays active until the end of the paid period; after expiry the Shared vault stays available read-only for another 30 days (you can export the data) and is then permanently deleted. Each member's private vault keeps working locally on the Free plan, and their local data remains theirs. Cancellation and refunds per the Refund Policy.

4. Zero-Knowledge Architecture and Master Password

Geslar uses zero-knowledge encryption: your passwords and vault contents are encrypted exclusively on your device, using a key derived from your master password. Geslar as the service provider has no access to your master key or vault contents at any time.

Only an encrypted blob — unreadable without your master key — is transmitted during synchronisation. Our servers never receive the plaintext password or master key, even in the event of a security incident on our infrastructure.

⚠ Important: Due to the zero-knowledge design, Geslar d.o.o. cannot recover your master password or access your vault contents. If you forget your master password without a backup, your vault contents become permanently inaccessible. We strongly recommend exporting your data regularly as a backup.

5. Plans and Billing

Free Plan is available to all users at no charge, with no time limit and without registration. All free features remain free forever — this is our unchangeable commitment to users.

Premium Plan is charged in advance as a monthly or annual subscription. It is activated immediately upon payment confirmation. Pricing and plan details are available on the Pricing page.

Automatic renewal: Your subscription automatically renews at the end of each billing period unless cancelled at least 24 hours before the renewal date. You can cancel via the subscription management link available in the Geslar Škrinjar application (Cloud → Manage subscription) or in Škrinjar on the web (my.geslar.app).

Trial period and billing: Registering an account automatically gives you 14 days of full Premium functionality, no card required. If you don't purchase a paid plan within that period, your account automatically moves to the Free plan — no charge is made. Billing occurs only when you actively choose to purchase the Premium or Family plan via Škrinjar on the web. At checkout you explicitly acknowledge that, having had the opportunity to try the service for free, you waive your right of withdrawal for the payment made (Art. 16(m) of Directive 2011/83/EU). Details in the Trial Period and Billing Policy.

Payment processor (private subscriptions): Payments for Premium and Family plans are processed through Creem (legal entity: Armitage Labs OÜ, Tallinn, Estonia), acting as the Merchant of Record. Creem is responsible for processing payments, calculating and collecting VAT, and issuing invoices. Geslar d.o.o. does not store payment card data. Business and organisational plans are not purchased self-service via Creem — they are arranged on request and billed separately.

6. Acceptable Use

You may use Geslar only for lawful purposes and in accordance with these terms. The following are prohibited:

Using the service to store, transmit, or process illegal content or data that infringes the rights of third parties.
Attempting to circumvent, breach, or probe the security mechanisms of Geslar services without written authorisation (unauthorised penetration testing).
Accessing the API through automated means in a way that burdens the infrastructure and degrades the service for other users.
Sharing access to a Premium account with third parties (except where a family plan explicitly permits this).
Reverse-engineering, decompiling, or extracting the source code of Geslar applications beyond what is permitted by law.

Violation of these rules may result in temporary or permanent suspension of access to the Geslar service, without entitlement to a refund of prepaid amounts, except where otherwise required by law.

7. Intellectual Property

The Geslar applications, design, logo, source code, and all accompanying content are the property of Geslar d.o.o. and are protected by copyright and other intellectual property laws. These terms do not transfer any ownership or licence other than the limited right to use the service in accordance with these terms.

Content you store in the Geslar vault (passwords, notes, attachments) is exclusively your property. Geslar does not acquire any rights to your content. Due to the zero-knowledge design, we are unable to access or process that content.

8. Limitation of Liability

To the extent permitted by applicable law, Geslar d.o.o. is not liable for:

Loss of data caused by a forgotten master password or the absence of a backup.
Loss of data resulting from user error, device failure, or deletion of the vault by the user.
Indirect, incidental, or consequential damages arising from the use of, or inability to use, the Geslar service.
Service interruptions caused by force majeure, infrastructure failures of third parties (e.g. Cloudflare, Hetzner), or cyber attacks.

In any event, Geslar's maximum liability to an individual user is limited to the amount paid for the Geslar service in the preceding 12 months, and in no case more than €100.

Consumer rights: The limitations in this section do not exclude or restrict statutory consumer rights arising from applicable consumer protection legislation and EU Directive 2019/770 on digital content. Limitations apply only to the extent permitted by law.

9. Privacy and Data Processing

The collection and processing of personal data is governed by a separate Privacy Policy, which forms an integral part of these terms. Geslar processes data in accordance with Regulation (EU) 2016/679 (GDPR).

10. Termination and Account Deletion

User: You may permanently delete your account at any time via the option in the Geslar Škrinjar application (Cloud → Delete account). Deletion is irreversible — all data stored on Geslar servers is permanently deleted within 30 days. Local data on your devices is not affected and remains on your devices.

Geslar: We reserve the right to suspend or terminate accounts with reasonable prior notice in the event of a breach of these terms, non-payment, or legal obligations. In the event of termination due to a breach of terms, no refund is due.

Data after termination: A cancelled plan stays active until the end of the paid period — everything keeps working until then (with a refund, paid features end immediately). After expiry the account switches to Free: your vault keeps working locally on your devices and cloud synchronisation turns off. The cloud copy of your data is kept for another 30 days — re-subscribing restores it — and is then permanently deleted from the servers. During that 30-day window the Shared vault is available read-only for export. Local data on your devices is not affected and remains yours.

11. Changes to Terms

Geslar d.o.o. reserves the right to amend these terms at any time. For material changes, we will notify registered users by email and/or via a notice on the News page at least 30 days before the changes take effect. Continued use of the service after the changes take effect constitutes acceptance of the new terms. An archive of previous versions of the terms is available on request.

12. Governing Law and Dispute Resolution

These terms are governed by the law of the Republic of Croatia. Disputes not resolved by mutual agreement shall be subject to the exclusive jurisdiction of the Commercial Court in Rijeka.

EU consumers: If you are a consumer habitually resident in the European Union, you have the right to use the European Commission's online dispute resolution platform: ec.europa.eu/consumers/odr. Mandatory consumer protection rules of your country of residence also apply.

13. Contact

For questions regarding these Terms of Service, please contact us:

Geslar d.o.o.
Email: [email protected]

We aim to respond within 5 business days.