Terms of use

Last updated: 18.10.2026

These terms govern your use of morphgate.com and of the hosted MorphGate sync service. They also explain how the MorphGate app relates to them. Please read section 5 in particular: we cannot recover your data if you lose your master password and your recovery key.

1. Who we are and what these terms cover

MorphGate is run by Vallic d.o.o., Josipa Jurja Strossmayera 341, 31000 Osijek, Croatia, registered under number 080946850, OIB 13852023036, VAT number HR13852023036 ("Vallic", "we", "us"). You can reach us at sync@morphgate.com.

These terms cover:

  • the website morphgate.com;
  • the hosted sync service ("the Service"): syncing encrypted vaults between your devices, the account and team pages on morphgate.com, and the team features;
  • paid plans and free trials of the Service.

You accept these terms when you create a sync account, create or join a team, or subscribe to a plan. The app asks you to accept them, with links to them and to the Privacy Policy, when you create an account, and Stripe Checkout asks again when you subscribe. Our Privacy Policy explains how we handle personal data. For teams, our Data Processing Agreement forms part of these terms.

If you accept these terms for a company or other organization, you confirm that you may bind it, and "you" includes that organization.

2. Words we use

App
The MorphGate desktop application.
Account
Your sync account on the Service, identified by your email address.
Vault
The encrypted collection of your hosts, credentials, keys, notes, snippets, attachments and session logs.
Team
An organization on the Service that owns shared vaults. Each team has one owner, and may have admins and members.
Customer
For a team, the organization on whose behalf the owner created it. For a personal account, you.
Seat
A place for one confirmed member of a team.

3. The MorphGate app

  • The app is free to download and use, with or without an account.
  • The app is open source. Its source code is at github.com/valicm/MorphGate. The licences in that repository govern how you may use, copy, change and share the software: the Mozilla Public License 2.0 for the desktop app and most of its components, Apache-2.0 or MIT (your choice) for the vault and sync libraries, the GNU Affero General Public License 3.0 for the reference sync server, and CC0-1.0 for the protocol specification. Where these terms and an open-source licence disagree about that software, the licence applies.
  • Under those licences the app is provided as is, without warranty. Section 13 applies to the Service; your statutory rights as a consumer are not affected.
  • The app checks for updates and installs only updates signed with the project's key. You can turn update checks off in the app. Installers are not yet code-signed for macOS and Windows.
  • The open-source licences do not give you rights to the MorphGate name or logo. The MorphGate name and logo belong to Vallic.
  • You are responsible for the servers you connect to with the app, and for having permission to access them.

4. The hosted sync service

  • The Service is optional. It stores your encrypted vault, syncs it between your devices and lets teams share vaults.
  • You can instead run the open-source reference sync server yourself, for free, under its licence. The software that runs the hosted Service is not open source.
  • To create an account you must be at least 16 years old and able to enter into a contract.
  • Each account is for one person. Give a working email address that you control and keep it up to date: security notices, sign-in links and codes go there.
  • We may change the Service, for example by adding or removing features. If a change removes a significant feature of a paid plan, we will tell you at least 30 days in advance, and you may cancel and receive a refund for the unused part of your period.

5. Your master password and recovery key

Your vault is encrypted on your devices. We never receive your master password, your recovery key or any key that decrypts your data. This means:

  • We cannot reset your master password, and we cannot decrypt or recover your data.
  • Your recovery key lets you choose a new master password if you forget it. Using it also turns off two-step verification. Store it somewhere safe and separate from your devices.
  • If you lose both your master password and your recovery key, your synced data cannot be decrypted by anyone, including us. Our support staff cannot help in that case.
  • Anyone who has your recovery key, or your master password and access to your email, may be able to take over your account. Treat both like passwords, and turn on two-step verification.
  • You are responsible for what happens through your account and your devices. Sign out devices you lose, and tell us at sync@morphgate.com if you suspect someone else is using your account.
  • The Service syncs; it is not a guaranteed backup. Keep your own exports of anything you cannot afford to lose.

6. Acceptable use

You must not:

  • use the Service or the app to break the law, or to store or share material you have no right to;
  • use the app or the Service to access systems you are not authorized to access;
  • attack, scan or probe the Service, or test its security, without our written agreement (to report a security problem, write to sync@morphgate.com);
  • get around rate limits, plan limits, seat limits or storage quotas, or create accounts in bulk or to obtain further free trials;
  • overload the Service or interfere with other users;
  • share one account among several people, or resell the Service, without our written agreement.

The Service has technical limits, which we may change with notice. Today they include 10,000 items per vault, 64 KiB per item, 25 MB per attachment or session log, and 1 GB of attachment and session-log storage per account or per team.

7. Plans, trials and billing

Plans

  • Personal: for one account, billed yearly.
  • Team and Business: for teams, priced per seat, billed yearly or monthly, with at least 3 seats. Business adds single sign-on, SCIM provisioning, device approval, team session logs, an audit stream and three years of activity log.

Current prices are on morphgate.com/pricing, in euros, US dollars or pounds sterling. Prices include VAT and other taxes; where tax applies, it is shown at checkout. A launch offer, where shown at checkout, applies to the first year only; renewals are at the normal price.

Free trials

  • A new account gets a 7-day free trial. A new team gets a 7-day free trial that includes the Business features. No payment details are needed.
  • Each email address gets one account trial and one team trial: only the first team an address creates starts with a trial. Deleting an account and registering again does not start a new trial.
  • When a trial ends without a plan, your devices stop syncing changes. You can still download your data to your devices.
  • If you subscribe while more than two days of your trial remain, the trial continues and the first payment is taken when it ends.

Payment and renewal

  • Payments are handled by Stripe. By subscribing, you authorize recurring charges to your payment method. Your card details never reach our servers.
  • Your subscription renews automatically at the end of each period, yearly or monthly, until you cancel.
  • If we change the price of your plan, we will tell you at least 30 days before the change applies to your next renewal. You can cancel before then.
  • Invoices and receipts are available in the Stripe Customer Portal.

Cancelling

You can cancel at any time in the Stripe Customer Portal: open it with Manage billing on your account page or, for a team, on the Billing tab of the team page (owner only). Your plan stays active until the end of the period you have paid for and is not renewed.

Failed payments

If a payment fails, Stripe tries again. Syncing keeps working for 14 days. After that, your devices stop syncing changes until the payment goes through. Your data stays on your devices and on the Service, and you can still download it.

Changing plan or seats

  • A team that moves from Team to Business is charged the prorated difference at once. If that payment does not go through, the change waits until it is paid.
  • A team that moves from Business to Team changes at once, and the difference is credited to its next invoice.
  • Seats are changed in the Stripe Customer Portal. Seat changes are prorated as Stripe calculates them. If a team has fewer seats than confirmed members, existing members keep access, but no new member can be confirmed until a seat is free.
  • When a team leaves Business, the Business features stop: a configured identity provider stays enforced until an admin removes it; provisioning can still remove people but no longer add them; device approval stays on until an admin turns it off; the audit stream pauses; new team session logs are refused, while existing ones remain until they expire; activity older than 365 days is deleted.

Refunds

We do not refund partly used periods after the withdrawal period, except where the law requires it, or where we close your account or end the Service without a breach by you.

Right of withdrawal (consumers in the EU, EEA and UK)

Withdrawal right: if you are a consumer, you may withdraw from a paid subscription within 14 days of buying it, without giving a reason, by cancelling in the Customer Portal or writing to sync@morphgate.com. If you asked us to provide the Service during those 14 days, we refund what you paid less a proportionate amount for the time you used it.

8. Teams: owners, admins and seats

  • The person who creates a team becomes its owner and accepts these terms for the Customer. Each team has one owner. The owner can transfer ownership to an admin.
  • Only the owner manages the team's plan and billing.
  • Owners and admins are responsible for who is in the team: invite only people the Customer authorizes, remove people promptly when they should lose access, and set policies such as required two-step verification, single sign-on and device approval as the Customer needs.
  • Adding a member and giving them access to vaults happens in an admin's app, because it needs vault keys that we do not have. After someone is removed, an admin's app should rotate the keys of the vaults they could open; the app shows when this is due.
  • A seat covers one confirmed member, including syncing that member's personal vault.
  • Identity providers and audit stream endpoints are chosen and run by the Customer, under the Customer's own agreements with them.
  • The Customer is responsible for having a legal basis for the team's personal data and for informing its members. Our Data Processing Agreement applies to that data.
  • The owner cannot delete their own account while they own a team: they must first transfer the team or delete it.
  • Deleting a team cancels its subscription and permanently deletes its vaults, items, attachments, session logs, members, invites, single sign-on and provisioning settings, audit stream and activity log. This cannot be undone.

9. Your content

  • Your vault and everything in it remain yours. You give us only the permission we need to store, copy, transmit and back it up, in encrypted form, to provide the Service. We cannot read it.
  • You are responsible for what you store, and for having the right to store it.
  • If you send us feedback or suggestions, we may use them without obligation to you.

10. Availability and support

  • We work to keep the Service available and your data safe, but we do not promise uninterrupted availability. There is no service level agreement unless we have signed one with you.
  • We may interrupt the Service for maintenance.
  • Your vault is also kept on your devices. While the Service is unavailable, the app keeps working with that local copy and syncs again once the Service is back.
  • Support is by email at sync@morphgate.com. Response times are not guaranteed unless agreed in writing.

11. Exporting and deleting your data

  • Your account data: choose Download your data on your account page, or use the export in the app.
  • Your vault contents: export them from the app, which decrypts them on your device.
  • A team's activity log: owners and admins can download it as CSV from the team page, or as CSV or JSON Lines from the app.
  • Deleting your account:  Delete your account on your account page, or write to sync@morphgate.com from your account's email address. Deletion removes your account, your personal vaults and their attachments, your devices and your team memberships, and cancels your subscription first. If billing cannot be reached at that moment, the deletion waits so that you are not charged afterwards. Items you added to team vaults belong to the team and stay. What else remains for a time is described in our Privacy Policy.
  • If your plan or trial ends: we keep your data and you can still download it. An account or team without a plan that nobody uses for 12 months (24 months if it ever had a paid plan) is deleted, after emails 30 days and 7 days before; using it in that time keeps it. Our Privacy Policy says what counts as using it.

12. Suspension and termination

  • You can stop using the Service at any time by cancelling your plan and deleting your account or team.
  • We may suspend or close an account or team if you seriously or repeatedly break these terms, if payment remains outstanding after the grace period, if the law requires it, or if it is needed to protect the Service or other users. We will tell you in advance and give you a chance to fix the problem where we reasonably can.
  • If we close an account or team without a breach by you, we refund the unused part of any prepaid period.
  • Unless the law or the reason for closing prevents it, you will have 30 days to export your data before we delete it.
  • We may stop offering the hosted Service altogether with at least 90 days' notice, and will refund the unused part of any prepaid period. The app and the open-source sync server remain available under their licences.

13. Disclaimer

To the extent the law allows, the Service is provided as it is and as available. We do not promise that it will be free of errors or fit for a particular purpose beyond what these terms describe. If you are a consumer, you keep all the rights the law gives you, including the right to a digital service that conforms to the contract.

14. Liability

  • We are not liable for loss of data that results from losing your master password and recovery key, because we cannot recover it.
  • For business customers, we are not liable for indirect or consequential loss, or for loss of profit, revenue, business or goodwill.
  • Our total liability arising from these terms in any 12 months is limited to the amount you paid us for the Service in the 12 months before the event.
  • None of these limits apply to liability for intent or gross negligence, for death or personal injury, or where the law does not allow liability to be limited. If you are a consumer, they apply only as far as the consumer law of your country allows.
  • If you use the Service for a business, you will compensate us for claims by third parties that arise from content you store or share through the Service, or from your breach of these terms, to the extent you caused them.

15. Changes to these terms

We may change these terms. We will publish the new version here and email account holders at least 30 days before a material change takes effect. If you do not agree, you can cancel and delete your account before then; if you cancel because of the change, we refund the unused part of any prepaid period. If you keep using the Service after the change takes effect, the new terms apply.

16. Governing law and disputes

These terms are governed by the law of the Republic of Croatia. The courts of Osijek, Croatia have jurisdiction. If you are a consumer, you keep the protection of the mandatory laws of the country where you live, and you may bring a claim in the courts there. We do not take part in out-of-court consumer dispute resolution proceedings.

17. General

  • These terms, the Privacy Policy and, for teams, the Data Processing Agreement are the whole agreement between you and us about the Service.
  • If a court finds part of these terms invalid, the rest stays in force.
  • If we do not enforce a right at once, we do not give it up.
  • You may not transfer your rights under these terms without our consent. We may transfer ours to a company that takes over the Service, and will tell you if we do.
  • We send notices to the email address of your account (for a team, the owner's). You can send notices to sync@morphgate.com.
  • These terms are written in English. If we provide a translation, the English version prevails, unless the law says otherwise.

18. Contact

Vallic d.o.o., Josipa Jurja Strossmayera 341, 31000 Osijek, Croatia. Email: contact@vallic.com.