Baluard
Source Get Baluardbeta
← Back to baluard.app

Privacy policy

Effective date: November 3, 2026

Baluard is designed so that your passwords, vault contents, and encryption keys stay on your devices. There is no Baluard account, cloud vault, analytics service, advertising tracker, or telemetry system. This policy explains the limited situations in which information is processed.

Information the software processes

The desktop app, browser extension, mobile app, and CLI process the information you put in your vault so they can provide password management, autofill, sync, and related features. Vault contents and encryption keys remain on your devices under normal operation. The software does not send them to us.

The browser extension reads the address of a page you visit to find matching logins. It sends the site address only to the Baluard software running on your own computer. It does not send browsing history or page contents to us.

Network connections and third-party services

The software connects to external networks only for operations you configure or enable:

  • Sync: Sync is optional. If you enable it, your encrypted vault is stored in a git repository that you choose and control. Your git provider receives the encrypted files and technical metadata needed to operate that repository under its own privacy policy. We do not receive a copy.
  • Update checks: The desktop app can check GitHub Releases for software updates with jittered requests. This check is optional and you can disable it in settings.
  • Website icons: Favicon retrieval is disabled by default. If enabled in settings, the app connects directly to the domain of a saved entry to fetch its icon.
  • Third-party distribution: Downloads, source hosting, and store distribution can involve third parties such as GitHub, Google, or Mozilla. Those services can process technical information such as your IP address, device information, and download activity under their own policies.

Website information

This website does not use analytics, advertising cookies, or tracking pixels. It can save your language preference in your browser's local storage. That preference stays in your browser.

The website is hosted by GitHub Pages. When you visit it, GitHub can process standard connection information such as your IP address, requested page, browser, and time of access to deliver and protect the site. We do not receive analytics profiles about you.

Support communications

If you email [email protected], we receive your email address, your name if you provide it, and the contents of your message. We use this information only to answer you, diagnose problems, improve Baluard, and keep a record of the support request. We keep support messages only as long as needed for those purposes or a legal obligation.

Please do not include passwords, recovery phrases, private keys, vault exports, or other secrets in a support message. Debug logs do not normally contain vault contents or keys, but please review any file before sending it.

If you post a public issue or comment on a code hosting service, the information you submit can be public. That service's privacy policy applies.

Where data protection law requires a legal basis, we process support information to respond to your request, pursue our legitimate interest in operating and improving Baluard, and meet legal obligations. Depending on where you live, you can have rights to access, correct, delete, restrict, or object to processing of your personal information. Contact [email protected] to exercise them.

Support providers and code hosting services can process information in other countries. Where required, appropriate safeguards apply to those transfers. We do not sell or rent personal information.

Security and retention

We use reasonable measures to protect the limited information we receive. No system is perfectly secure. Baluard's local-first design limits what can reach us in the first place; the security white paper explains the product architecture in detail.

We keep personal information only as long as needed for the purposes described here. You can ask us to delete support correspondence, subject to records we must keep by law.

Children

Baluard is not directed at children under 13, and we do not knowingly collect their personal information. A parent or guardian who believes a child sent us personal information can contact us to request deletion.

Changes and contact

We can update this policy as Baluard changes. The effective date at the top shows the latest revision. Material changes will be posted on this page.

Questions or privacy requests: [email protected].