Privacy policy

Last updated: 18.10.2026

This policy explains what personal data Vallic collects when you visit morphgate.com, use the MorphGate app and use the hosted MorphGate sync service. It covers why we collect it, how long we keep it, who else receives it and what you can do about it.

The short version

The MorphGate app works without an account and sends us nothing. It asks GitHub whether an update exists, and you can turn that off.
If you use hosted sync, your vault is encrypted on your device before it leaves it. We store ciphertext we cannot read. We never receive your master password or your recovery key.
We keep what we need to run your account: your email address, your devices, your plan and, if you are in a team, your membership and the team's activity log.
The public pages of the website use Google Analytics to count visits, but only if you accept it in the cookie banner; until then nothing is sent to Google. The account, team, invite, sign-in and payment pages never load it. There is no advertising.
We do not sell personal data.

Who we are

MorphGate is run by Vallic d.o.o., Josipa Jurja Strossmayera 341, 31000 Osijek, Croatia, registered under number 080946850, OIB 13852023036, VAT number HR13852023036 ("Vallic", "we", "us"). Our website is vallic.com.

For anything about privacy, write to sync@morphgate.com.

We are the controller for the personal data described in this policy, with one exception. When you are a member of a team on the hosted service, the organization that runs the team decides how the team's data is used, and we process that data on its behalf. See the section on teams below and our Data Processing Agreement.

What we cannot see

MorphGate encrypts your vault on your device. The hosted service stores only:

ciphertext: your hosts, usernames, passwords, keys, notes, snippets, attachments and session logs, encrypted with keys that only your devices hold;
public keys;
slow hashes (Argon2id) of values your app derives from your master password and your recovery key.

We never receive your master password, your recovery key or any key that decrypts your vault. We cannot read your vault, the names of your vaults or what you do in your sessions. We cannot reset your master password or recover your data for you. If you lose both your master password and your recovery key, nobody can decrypt your synced data, including us.

Two secrets are stored in a form the server can read back, because it has to use them: the secret behind your two-step verification codes, and a team's single sign-on client secret. Both are encrypted at rest with a key kept outside the database.

What we can see is listed below. It includes your email address, your device names, how many items and attachments you store and roughly how large they are, when they changed, and which teams you belong to.

What we collect, and why

When you visit morphgate.com

Our CDN. Every request to morphgate.com passes through Vallic's content delivery network, which runs on bunny.net. It sees your IP address, the address of the page you ask for, the time, your browser's user agent and the country your IP address belongs to. It uses them to deliver pages from a server near you and to protect the site with a web application firewall and protection against bots and denial-of-service attacks. It keeps request logs for 7 days.
Our servers. The web server's access log records which page was asked for, the response status, how long it took and when. It does not record your IP address, the query string or your user agent. Our application log records errors and notable events, such as a page that was not found, together with the page address and the IP address that asked for it. It keeps only the most recent 1,000 entries.
Visit statistics. If you accept in the cookie banner, the public pages (home, pricing, download, docs and similar) load Google Analytics through Google Tag, to count visits and see which pages people read. Google then receives the address of each page you open, your browser and device details and your IP address, and sets the cookies listed under Cookies. Advertising features stay off. Until you accept, or if you decline, the pages do not load Google Analytics at all and nothing is sent to Google. The banner keeps your choice in your browser's local storage for six months, without sending it to us; Cookie settings at the bottom of every page changes it, and declining deletes the Google Analytics cookies. The account and team pages, sign-in links, invites, single sign-on, billing and admin pages never load it, so no account data or one-time link reaches Google. There are no social media plugins and no other tracking pixel. The site serves its own fonts and scripts.
Downloads. The app's installers are published on GitHub. When you download one, your browser fetches it from GitHub, which receives your IP address under the GitHub General Privacy Statement.

We process this data to deliver the website and keep it secure (legitimate interests, Art. 6(1)(f) GDPR).

When you use the app without an account

The app keeps your vault in an encrypted file on your computer. It has no telemetry, analytics or crash reporting. Without a sync account it sends nothing to us.

Update checks. When it starts and twice a day, the app downloads a small release file from GitHub to see whether a newer version exists. GitHub receives your IP address and the request; we do not. You can turn update checks off under About in the app. The app installs an update only if it is signed with the project's key.
Your connections. SSH, SFTP and VPN connections go straight from your computer to the servers you choose. They do not pass through us.
Your own sync server. If you sync through a vault-sync server you run yourself, we receive nothing. Whoever runs that server is responsible for the data on it.

When you have a sync account

We use the following to provide the service you signed up for (contract, Art. 6(1)(b) GDPR), unless another reason is given.

Email address: Identifies your account. We use it to sign you in, to send six-digit confirmation codes and sign-in links for the account page, and to send security notices: a new device signed in, your master password or recovery key changed, your recovery key was used, two-step verification was turned on or off, or your email address changed. We also send trial reminders and team messages, such as invites and removal notices. We do not send newsletters or marketing email. Our messages contain no tracking pixels or remote images.
Sign-in and key data: The settings your app used to derive keys from your master password, an Argon2id hash of the sign-in key your app derives, your private keys encrypted under your master password and, separately, under your recovery key, a hash of a recovery proof, and your public keys. They let you sign in on new devices and recover your account. We cannot use them to read your vault.
Two-step verification: If you turn it on: the encrypted secret behind your codes, and a marker of the last code used so that each code works only once.
Devices: For each device that signs in: an ID, a name (by default your computer's name), its operating system, the app version, the device's public key, when it first signed in and was last seen, and whether it has been signed out. You can see this list in the app and on the account page, and sign devices out.
Sessions: Sign-in tokens, stored only as hashes. Access tokens last 15 minutes and refresh tokens 90 days.
Your encrypted vault: Encrypted items, attachments and session logs, with what we need to sync them: sizes (padded, so exact sizes are hidden), counts, revision numbers, dates, and which account wrote each item.
Plan and trial: Your plan, its status, the number of seats, when the current period or trial ends, and which trial reminders we have sent. To give each email address one free trial, we keep a keyed hash of the address, not the address itself, in a list of addresses that have had a trial. This entry stays after you delete your account, so deleting and registering again does not start a new trial (legitimate interests: preventing abuse of free trials).
Account page: When you sign in at morphgate.com/account, we create a website user linked to your account. It is named after your account ID and holds your email address. Your session on the website records your IP address and when it was last used. Sign-in links are stored as hashes and work once: for 60 seconds when opened from the app, or for 15 minutes when emailed.
Confirmation codes: Stored as a keyed hash, never as the code itself, for 15 minutes.
Abuse protection: To stop password guessing and abuse, we count requests per IP address to sign in, sign up, recover an account, send invites and request sign-in links, and we count two-step verification attempts per account. Each counter is kept only for the time window of its limit, at most one hour (legitimate interests: security).

Teams

A team is run by its owner and admins. For the team's data, the organization that runs the team is the controller and we are its processor under our Data Processing Agreement. Your own account, described above, stays with us as controller. If you have questions about how your team uses your data, ask its owner or admins first. We will help them answer.

For team members we store:

the team's name, your role (owner, admin or member), whether your membership is confirmed, and when you joined;
signatures your admins' apps made over your public keys, and the team's vault keys sealed so that only your devices can open them, with your permission on each vault;
invites: the invited email address, the role and the vaults offered, for 7 days or until the invite is accepted or cancelled;
the team's activity log: membership and role changes, vault access, key rotations, new devices signing in (with the device name), device approvals, single sign-on sign-ins, and changes made by the team's identity provider. Events carry account IDs, and invite events carry the invited email address. The log contains no IP addresses and never records what you open or run. The team's owners and admins can read and download it.

Teams on the Business plan, and teams during their free trial, can also use:

Single sign-on (OIDC or SAML). We store the identifier the team's identity provider uses for you and when your sign-in on each device expires. We check that the email address the provider returns matches your account.
SCIM provisioning. The team's identity provider tells us whom to invite or remove. We store your email address, the provider's ID for you and whether you are active.
Device approval. Each device waiting for approval, approved or denied, who decided and when. Admins are emailed when a device is waiting.
Audit stream. The team's activity events, including members' email addresses, are sent to an endpoint the team chooses, such as its own security monitoring system.
Team session logs. Recordings of terminal sessions, encrypted on the device like other vault data. Team members with access to the vault can read them; we cannot. The team decides how long they are kept.

Identity providers and endpoints that a team connects are chosen and controlled by the team, not by us.

When you pay

Payments go through Stripe Checkout and the Stripe Customer Portal. Stripe collects your payment details, name, billing address and, where it applies, your tax ID. Your card details never reach our servers.
To set up a subscription, we send Stripe the email address of the person subscribing and an internal reference to the account or team.
We store the Stripe customer and subscription IDs, the price and currency you pay in, your plan, your seats and when the period ends. We keep the IDs of Stripe's notifications for 30 days, so that each one is applied only once.
To show prices in your currency on the account and team pages, we use the country our CDN reports for your connection and your browser's language at that moment. We do not store either.
Stripe sends receipts and failed-payment notices itself.

We process this data to provide your plan (contract) and to keep invoices and accounting records as the law requires (legal obligation, Art. 6(1)(c) GDPR). Stripe also processes payment data for its own purposes, such as preventing fraud and meeting its legal obligations, as an independent controller under the Stripe Privacy Policy.

Support and running the service

The people who run the service can see the account information described above: email address, devices, plan, storage sizes and teams. They can never see vault contents. At your request, or to deal with a problem, they can email you a sign-in link, sign your devices out, extend a trial, grant a plan or delete an account. They cannot reset your master password or turn off your two-step verification. Each such action is logged with the staff member's name.
Our monitoring uses counts only, such as how many accounts or devices exist, with no addresses, names or IDs. Alerts to our staff about subscriptions identify accounts and teams by internal ID only.

We do this to support you and to keep the service running and secure (legitimate interests).

Legal bases

Contract (Art. 6(1)(b) GDPR): your account, sync, the team features of your own account, plans and billing, and the service emails that go with them.
Legitimate interests (Art. 6(1)(f) GDPR): keeping the website and service secure (CDN protection, rate limits, logs), preventing abuse of free trials, keeping a record of what our staff do, and running the service with aggregate counts. You can object at any time (see Your rights).
Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and accounting records, and answering lawful requests from authorities.
On behalf of a team (Art. 28 GDPR): team data is processed on the organization's instructions. The organization is responsible for its own legal basis.

Visit statistics with Google Analytics: your consent (Art. 6(1)(a) GDPR, and the ePrivacy rules on reading or storing information on your device), given in the cookie banner and withdrawn at any time under Cookie settings at the bottom of every page. We send no marketing.

How long we keep it

Account, devices and plan: Until you delete your account, or until it is deleted for not being used (see Accounts and teams nobody uses). Devices you signed out stay listed until then.
Encrypted vault items: Until you delete them or your account. A deleted item leaves a marker with no content, which is removed after 90 days.
Attachments and session logs: Until you delete them, the vault or your account. Team session logs are also deleted after the period the team sets, if it sets one.
Sign-in tokens: 15 minutes (access tokens) or 90 days (refresh tokens), then deleted.
Confirmation codes and sign-in links: 15 minutes; sign-in links opened from the app, 60 seconds.
Invites: 7 days.
Single sign-on: Sign-ins in progress, 10 minutes. Signed-in devices, the period the team sets (1 to 720 hours).
Team activity log: 365 days, or 1,095 days (three years) for teams on the Business plan.
Trial list: 24 months from the trial, then deleted. After that, the address can have a trial again.
Rate-limit counters: At most one hour.
Account page sessions: We end a session after 30 minutes without activity, or after 12 hours in total. The server-side record is removed when you sign out, or otherwise usually within three days.
Logs: Application log: the most recent 1,000 entries. Other server logs: 7 days. CDN logs: 7 days.
Stripe notification IDs: 30 days.
Invoices and billing records: Statutory retention period for accounting and tax records in Croatia is 10 years.
Support emails: sync@morphgate.com and contact@vallic.com
Backups: Deleted data stays in our encrypted backups until those backups expire, at most 7 days later.
Accounts without a plan: An account without a running trial or plan that nobody uses for 12 months (24 months if it ever had a paid plan) is deleted, with its synced vaults, as if you had deleted it. Using it means signing in or syncing from the app, or signing in to the account page. We email you 30 days and again 7 days before; using the account in that time keeps it. An account is kept while it has a seat in a team with a plan, and while it owns a team. A team without a plan that none of its members uses for the same period is deleted the same way, after the same two emails to its owner.

Who receives your data

Hosting: Vallic Cloud

The service runs on Vallic Cloud, Vallic's own hosting platform, in London. The platform uses underlying data-centre and infrastructure providers for its machines and keeps encrypted backups as stated in Vallic Cloud DPA, Annex III — Sub-processors.

CDN and security: bunny.net

Vallic's CDN runs on bunny.net, operated by BunnyWay d.o.o., Slovenia. It carries all traffic to morphgate.com, including the app's sync traffic, and provides the web application firewall and protection against attacks. Your vault data stays end-to-end encrypted on the way through it.

Payments: Stripe

Stripe processes payments, invoices and tax.

Visit statistics: Google

Google Ireland Limited receives the page views of the public pages through Google Analytics, as our processor under Google's data processing terms. Google may process the data in the United States.

Email:

MailerSend, Inc: Delivers the emails we send: codes, sign-in links, security notices, reminders and team messages.

Proton AG: All communication directly with customers

Your team

If you are in a team, its owners and admins see your email address, your role, your devices waiting for approval and the team's activity log. The team's identity provider and audit stream endpoint receive the data described under Teams.

Authorities

When the law requires it. We will tell you unless we are not allowed to. We cannot hand over vault contents, because we cannot read them.

GitHub receives the app's update checks and installer downloads directly from your computer, under GitHub's own privacy statement. We do not sell personal data or share it for advertising.

Transfers outside the EEA

Our servers, database and file storage are in London, United Kingdom.
The CDN answers each request from an edge location near the visitor. It has locations in Europe, Asia and the Americas. A request from outside Europe is usually handled outside the European Economic Area.
Stripe may transfer payment data to Stripe, Inc. in the United States.
Google may transfer Google Analytics data to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework.
Backup storage: Cloudflare, Inc. is a US company, even where the data is stored in Europe, under EU Jurisdiction.
MailerSend, Inc as transactional provider, and Proton AG as main mail server.

Where personal data goes to a country without an EU adequacy decision, we rely on the European Commission's standard contractual clauses or, for US companies certified under it, the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards.

Security

Vault data is encrypted on your devices with XChaCha20-Poly1305, under keys that are themselves protected by your master password (through Argon2id). Shared vault keys are sealed to each member's own key (X25519), and items are signed (Ed25519).
Your sign-in key is hashed with Argon2id on the server. Tokens, sign-in links, invite links and provisioning tokens are stored only as hashes.
All traffic uses TLS, and the site asks browsers to use HTTPS only.
Sign-in, sign-up, recovery and invites are rate-limited. Two-step verification is available to everyone, and teams can require it, require single sign-on and require new devices to be approved.
Staff access to account information is limited to the people who run the service, and their actions are logged. Backups are encrypted.

No system is perfectly secure. If a breach puts your rights at high risk, we will tell you without undue delay.

Your rights

Under the GDPR you have the following rights.

Access and portability. Sign in at morphgate.com/account and choose Download your data to get a JSON file with everything readable we keep about your account: account details, devices, plan, team memberships, vault statistics, invites, provisioning records, single sign-on sessions, your team activity and billing references. The app offers the same export. Your vault contents are exported from the app, because only your devices can decrypt them. Invoices are in the Stripe Customer Portal.
Correction. Change your email address in the app. For anything else, write to us.
Deletion. Sign in at morphgate.com/account and choose Delete your account. To protect you, the page asks that you signed in within the last 15 minutes, that you type your email address, and for a code if you use two-step verification. Team owners delete a team on its page the same way. We email you a confirmation. You can also write to sync@morphgate.com from your account's email address. We delete your account, your personal vaults with their items and attachments, your devices and sessions, your website user and your team memberships at once. We cancel any subscription first; if Stripe cannot be reached at that moment, the deletion waits, so you are not charged afterwards. If you own a team, transfer it to an admin or delete it first. Some things remain:
- items you added to team vaults, and team vaults you created, belong to the team and stay;
- team activity log entries about you stay until the log's retention period ends; they hold your account ID and, for invites, your email address;
- records a team's identity provider keeps with us for your address, until the team removes them;
- the keyed hash of your address in the trial list;
- invoices and billing records, at Stripe and in our accounts, for as long as the law requires;
- copies in encrypted backups, until those backups expire.
Restriction and objection. You can ask us to limit how we use your data, and object to processing based on legitimate interests. We will stop unless we have compelling reasons, such as keeping the service secure.
Complaint. You can complain to a data protection authority, in particular where you live or work. In Croatia this is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), azop.hr.

To use any of these rights, write to sync@morphgate.com. We answer within one month. To protect your account, we may ask you to write from your account's email address or to sign in to the account page. If your request concerns a team's data, we pass it to the team, which decides, and we help it answer.

Cookies

Browsing the public pages sets no cookies until you accept analytics cookies in the cookie banner. The account and team pages use only what they need to work:

SSESS followed by a random string: The session cookie of the site's software, Drupal. It is set when you sign in to the account or team pages and keeps you signed in. It is also set briefly when you send a form, such as the sign-in form, so the next page can show a confirmation. It is sent only over HTTPS and cannot be read by scripts. Your browser may keep it for up to 23 days, but we end the session after 30 minutes without activity or 12 hours in total.
big_pipe_nojs: Set only if you are signed in and your browser has JavaScript turned off, so that pages load without scripts.
bunny_shield_id_{numeric}: The CDN's bot protection challenges a visitor, it may set a cookie to remember that the check was passed.

These cookies are strictly necessary, so we do not ask for consent. The cookie banner keeps your choice under morphgate.consent in your browser's local storage, which is not sent to us, for six months; that too is strictly necessary, to remember the choice. With your consent in the cookie banner, Google Analytics sets _ga and _ga_E5C5RWXZSM on the public pages, kept up to two years, to tell visits apart; without it, none. The pages where you pay and manage billing are on stripe.com, where Stripe sets its own cookies under its own policies.

Children

MorphGate is a tool for people who manage servers. It is not directed at children, and you must be at least 16 to create an account. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

When we change this policy, we publish the new version here with a new date. If a change matters to how we use your data, we also email account holders at least 30 days before it takes effect.

Contact

Vallic d.o.o., Josipa Jurja Strossmayera 341, 31000 Osijek, Croatia. Email: contact@vallic.com

See also our Terms of Use and, for teams, our Data Processing Agreement.