Speak freely, without tying the conversation to your identity.
Nothing that identifies you. Vaultlix does not require an account, email address, phone number, or any personal information to use.
What exists on our servers is:
Your session token is created by the server when you open or join a vault, then kept on your device too — in your browser's own localStorage, so the app can restore your open vaults if you reload or reopen it, and in IndexedDB if notifications are enabled, so a push notification can be matched to the right vault without a browser tab needing to be open. It travels with each request to prove you belong to that vault. It isn't an identity, isn't tied to you, and stops working the moment the vault closes. While a vault is open the server holds it in memory, and it may briefly appear in a restart snapshot — see "How messages work" below.
All messages are end-to-end encrypted using AES-256-GCM with keys generated in your browser. The server never sees your message content — only encrypted ciphertext that it cannot read.
There is no traditional database and no ongoing backups — server-side data lives only in memory during normal operation. The one exception: in the brief moments during a planned server restart (for example, a deployment), the server writes a temporary snapshot of that same in-memory data to disk purely so open vaults aren't wiped out, then reloads and deletes that snapshot the moment it's back online. This snapshot holds nothing beyond what the server already had in memory — the same encrypted message content, not new plaintext — and it does not help against an unexpected crash, only a graceful restart.
A vault and everything in it (messages, member names, subscriptions) is deleted immediately if either person uses "Close & erase." Otherwise, a temporary vault is automatically and permanently deleted after 24 hours of inactivity, measured from the last activity in that vault, not from when it was created. Simply closing your browser tab does not immediately delete a vault; the idle timer above is what eventually does. A permanent vault does not have an inactivity timer at all — it stays available indefinitely until someone uses "Close & erase" or revokes it from within the app, at which point it and everything in it are deleted the same way.
Disappearing-message timers, when enabled, delete an individual message from the server as soon as its timer expires, independent of the vault's own lifetime.
Files are encrypted in your browser before upload, transmitted as encrypted data, and delivered directly to the recipient. Files are not stored on our servers beyond the same vault lifetime described above.
Calls are set up over an encrypted signaling channel, and the connection itself is encrypted in transit (DTLS-SRTP, standard for WebRTC calls). To protect both callers' IP addresses from being exposed to each other, call audio — and video too, if either person turns their camera on — is always relayed through a TURN server operated by Cloudflare, rather than connecting the two devices directly. This means a call is not end-to-end encrypted the same way text messages are — Cloudflare's relay is technically an intermediary point in the connection, though it is not a party we share data with beyond what's needed to relay the call, and no call audio or video is recorded or stored by Vaultlix.
We do not use cookies, analytics trackers, advertising pixels, or any third-party tracking tools. We do not use Google Analytics or any equivalent service.
Vaultlix is hosted on Railway (railway.app). Railway may collect standard infrastructure logs including IP addresses. Please review Railway's privacy policy for details. We use Google Fonts for typography — fonts are loaded from Google's servers. Voice and video calls are relayed through Cloudflare's TURN service. Push notifications are delivered through Apple's and Google's respective push notification services, which see that a notification was sent to your device but not its content.
Vaultlix is not intended for use by anyone under the age of 18. We do not knowingly collect information from minors.
Vaultlix is operated from India and this policy is governed by Indian law, as stated below. If you access Vaultlix from another country, you do so on the understanding that your data may be handled under Indian law; where the law of your own country grants you additional rights that cannot be waived, this policy does not limit those rights.
If we receive a valid legal request — a court order or a request from law enforcement made under applicable Indian law — we will review it and respond as required by law. What we can actually provide is limited by how Vaultlix is built: we can only disclose what exists in server memory at the moment the request is received (the encrypted content of an active vault, the display names in it, and whatever standard access logs Railway retains) — we cannot decrypt message content ourselves, and we cannot produce anything for a vault that has already been closed or has already expired, because nothing remains anywhere once that happens.
To report abuse, suspected illegal content, or a violation of our Terms of Service, contact legal@vaultlix.com. We may act on a credible report by disabling or deleting the vault in question. We do not proactively monitor message content — because it's end-to-end encrypted, we couldn't even if we wanted to — so we only become aware of what a specific vault contains if it's reported to us, or compelled by valid legal process while that vault still exists.
We may update this policy from time to time. Updates will be reflected on this page with a revised effective date.
This policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.
Vaultlix is an anonymous, encrypted messaging, voice, and video-calling service. It allows two people to communicate privately without accounts or stored data. Vaults are temporary: they are deleted immediately when either person uses "Close & erase," and otherwise expire automatically after a period of inactivity, as described in our Privacy Policy.
You may use Vaultlix for any lawful purpose. You may not use Vaultlix to:
Vaultlix is provided "as is" without warranties of any kind. We do not guarantee that the service will be available, error-free, or suitable for your specific needs.
To the fullest extent permitted by law, Vaultlix and its operators shall not be liable for any direct, indirect, incidental, or consequential damages arising from your use of the service.
Your use of Vaultlix is also governed by our Privacy Policy.
We reserve the right to terminate or restrict access to Vaultlix at any time, for any reason, without notice.
To report suspected illegal activity, abuse, or a violation of the Acceptable use section above, contact legal@vaultlix.com. We may suspend, disable, or delete any vault without notice if we believe it violates these terms.
We will cooperate with valid legal process to the extent legally required. Because Vaultlix is deliberately built to retain as little as possible, what we're actually able to provide is limited to whatever exists in server memory at the time a request is received — see the Privacy Policy for exactly what that is, and what it no longer includes once a vault has closed or expired.
These terms are governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of courts in Chennai, Tamil Nadu.
For any questions regarding these terms, contact us at legal@vaultlix.com
A private chat app for two people — no accounts, no phone numbers, nothing we can read. Open a vault, share the code, talk, then close it. Everything inside is destroyed, not archived.
No. There's no sign-up and Vaultlix never asks for a phone number. Pick any name for the conversation, and that's it.
There's no identity system to unmask — Vaultlix doesn't know who you are and doesn't keep a persistent profile tied to any device or account.
Yes — messages and voice/video calls are both end-to-end encrypted, decrypted only on the other person's device. The private key that does the decrypting is created in your browser and never leaves it.
It's deleted immediately, for both people, along with everything inside it. Not archived, not hidden — gone.
A temporary vault is for one conversation and expires within a day. A permanent vault never expires — reopen it anytime with the same code.
No — Vaultlix is built for one-to-one conversations only.