BobWork Vault — Privacy Policy
BobWork Vault is a team password manager made by BobOffice, LLC (131 Continental Dr, Suite 305, Newark, DE 19713, USA). This policy covers the BobWork Vault browser extension and the web app at vault.bobwork.ai.
Anyone can sign up. Creating an account without an invite starts a new organisation, and you become its admin; creating an account with an invite code joins the inviter's organisation. Each account belongs to one organisation.
1. Zero-knowledge design
Your passwords, usernames, notes and 2FA secrets are encrypted inside your browser with a key derived from your master password (PBKDF2-SHA256, 600,000 iterations, then AES-256-GCM). Our servers only ever receive ciphertext. We never receive your master password or any key that can decrypt your data, so we cannot read, recover or hand over your vault contents.
2. What we store
- Account: your name, email address, the organisation you belong to (its name and whether you are an admin), a salted hash derived from your master password (used only to check sign-in), your public key, and your private key encrypted with your own key.
- Vault items: encrypted blobs, and for each person with access, the item key encrypted to that person's public key.
- Security records: sign-in times, trusted-browser fingerprints (a hash of a random ID stored in your browser), and an audit log of actions such as “opened”, “copied” or “shared” (item IDs, never contents).
- Organisations: the organisation name chosen at sign-up (admins can rename it) and which accounts, invites, items and audit records belong to it.
- Website icons: to show a site's logo, the app and extension may ask our own logo service for the icon of a domain name only (e.g.
stripe.com) — no account, item or sign-in token is sent, and we fetch and cache the icon ourselves so no third party learns which sites you use (Google's favicon service is our last-resort source, asked by our server). About 270 popular brands are built in and need no request at all. Turn this off under Settings › Show website icons. A logo you choose for an item is stored encrypted inside that item.
2a. Organisations are kept apart
Every account, invite, item and audit record is tied to one organisation. You can only see, share with, invite, remove or audit people in your own organisation; other organisations cannot see that you exist. Within an organisation, each item stays private to its owner until the owner shares it. To prevent abuse of open sign-up we keep the IP address of sign-up requests for rate limiting.
3. What the extension does on web pages
To autofill and offer to save logins, the extension reads login forms on the pages you visit. It only reads a page's username and password fields when you sign in or ask it to fill, keeps what it reads in memory for up to three minutes to offer saving, and sends it to our server only after encrypting it — and only if you press Save. It does not track browsing history, read other page content, show ads, or sell or share data.
4. Email
We email a one-time code to your address when you create an account and when you sign in from a new browser, and, if your organisation admin chooses, an invite with setup steps. Emails are sent with Resend (resend.com). No other emails are sent.
5. Where data lives
Encrypted data is stored in a PostgreSQL database hosted by Supabase (United States) and served through Vercel. Both only see ciphertext.
6. Your choices
You can delete any item at any time. To delete your account and all items you own, email info@bobwork.ai; we delete within 30 days. An organisation admin can also remove a member of their organisation: that member is signed out, their unshared items are deleted, and shared items they owned pass to another member who already has access. A lost master password cannot be recovered by anyone, including us.
6a. Website analytics
Our public pages (this privacy page, the home page and the invite guide) use Google Analytics to count visits and clicks on “Create a free account” and “Add to Chrome”. Google Analytics is never loaded inside the vault itself, where you sign in and see passwords, or inside the extension. It does not receive any vault data.
7. Chrome Web Store Limited Use
The use of information received from Google APIs and browser data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the password-manager features described above.
8. Contact
BobOffice, LLC · info@bobwork.ai · bobwork.ai
隐私政策（简体中文）
网站统计：公开页面（首页、邀请指南、本隐私页）使用 Google Analytics 统计访问量以及「免费创建账户」「添加至 Chrome」的点击。密码库本身（登录与查看密码的页面）和扩展程序从不加载 Google Analytics，也不会发送任何密码库数据。
BobWork Vault 由 BobOffice, LLC 提供，是一款零知识团队密码管理器。你的密码、用户名、备注和两步验证密钥都在你的浏览器内用主密码派生的密钥加密后才上传；我们的服务器只保存密文，永远拿不到你的主密码或任何能解密的密钥，因此无法读取或找回你的内容。
任何人都可以免费注册。不使用邀请码注册会建立一个新的组织，你是该组织的管理员；使用邀请码注册则加入邀请人的组织。每个账户只属于一个组织。各组织完全隔离：你只能看到、共享给、邀请、移除或审计同一组织的成员，其他组织看不到你。在组织内，每个项目在拥有者共享之前都只属于拥有者本人。为防止滥用，我们会记录注册请求的 IP 地址用于限流。
扩展只在你登录或要求填入时读取网页上的登录栏位，只有在你按“保存”后才会加密上传；不追踪浏览记录、不投放广告、不出售或分享数据。为显示网站图标，应用和扩展可能向我们自己的图标服务请求某个域名的图标（例如 stripe.com），不发送账户、项目或登录凭证；约 270 个常用品牌已内置，无需请求。可在「设置 › 显示网站图标」关闭。你为项目选择的图标加密保存在该项目内。注册账户和新浏览器登录时会通过 Resend 发送一次性验证码。加密数据存放于 Supabase（美国），经由 Vercel 提供服务。如需删除账户，请写信至 info@bobwork.ai。