Terms of Use and Purchase

These terms apply to the use and purchase of Ko | Do · Vault. By creating a vault you accept them, including if you only use the free trial.

1. Seller

Ko | Do · Vault is provided by Me & Max AS, company no. 987 607 882 MVA, Stigerbakken 7, 1348 Rykkinn, Norway. Contact: kontakt@kodovault.no.

2. What the service is

Ko | Do · Vault is a browser-based, encrypted vault for passwords, payment cards and ID documents. All encryption and decryption happens locally on your device. We store only encrypted data and cannot read the contents.

At present the key is derived using PBKDF2-SHA256 (600,000 iterations) and data is encrypted with AES-256-GCM. We may upgrade to stronger methods over time. Such changes will never weaken the security of the service.

3. Who may enter into this agreement

You must be 18 years old and have legal capacity to enter into this agreement. If you are under 18, a guardian must enter into the agreement on your behalf. The guardian is then the contracting party and responsible for the subscription.

4. Your master password — read this carefully

The master password is the only key to your vault. It never leaves your device, and we hold no copy and have no backdoor.

• If you forget it, your data is permanently lost.
• There is no password reset, no recovery and no support that can unlock the vault for you.
• You are responsible for storing the master password safely and for keeping backups. See section 10 on export.

This is a deliberate design choice, not a shortcoming. It is the condition that makes it impossible for anyone else — including us — to read your data.

5. Free trial

The trial is free for 30 days and requires no card details. It does not convert automatically into a paid subscription.

• We notify you by email 5 days before the trial expires.
• If you choose no paid plan, the vault is locked on expiry. A locked vault cannot be used — you can neither look up nor change its contents.
• You may still export your data throughout the 28-day period, at no cost. See section 10.
• The data is kept for 28 days after locking. You receive an email warning 7 days before deletion.
• After 28 days the data is permanently deleted. If you upgrade within the deadline, the vault reopens with its contents intact.

6. Prices and payment

• Current prices are shown at kodovault.no. All prices include VAT.
• Payment is handled by Stripe. We never receive your card number.
• Subscriptions renew automatically until cancelled.
• Price changes are announced by email at least 30 days in advance. You may cancel before the change takes effect.

7. Right of withdrawal

You have a 14-day right of withdrawal from the date of purchase under the Norwegian Right of Withdrawal Act. Contact kontakt@kodovault.no and we will refund the full amount. No reason required, and we make no deduction for the period you have used the service.

You may notify us in any way you like — a plain email is enough. If you prefer the statutory Norwegian withdrawal form, it is available here: angreskjema.

8. If a payment fails

If a renewal fails, we retry the charge and notify you by email. If payment is still not completed, the vault is locked. The same deadlines then apply as for an expired trial: the data is kept for 28 days, with a warning 7 days before deletion. If you settle payment within the deadline, the vault reopens with its contents intact.

9. Cancellation

You may cancel at any time through the Stripe customer portal. You keep access for the remainder of the paid period. We do not refund unused time beyond the right of withdrawal in section 7.

10. Export and deletion of your data

As long as you have access to the vault, you may export the entire contents yourself at any time — either as an encrypted backup file, or as CSV in a Bitwarden-compatible format. We recommend exporting regularly, not only when a deadline approaches.

This applies to a locked vault as well. Throughout the 28-day period before deletion you can export your data, at no cost.

You may also permanently delete your vault and account from settings. Deletion is final and cannot be undone. Invoices and accounting records are retained by us for five years, because the Norwegian Bookkeeping Act requires it.

11. Privacy

How we process personal data is described in our privacy policy. In short: vault contents are encrypted on your device and cannot be read by us. We use processors for operations, payment and email — among them Vercel (hosting), Upstash (database), Stripe (payment) and Resend (email). The policy contains the full list.

12. Availability and liability

We aim for high uptime but cannot guarantee uninterrupted availability. We reserve the right to downtime, maintenance and faults at subcontractors.

Our total liability is limited to the amount you have paid for the service in the past twelve months. We are not liable for indirect losses, and not for data loss resulting from a forgotten master password or missing backups. These limitations do not apply in cases of gross negligence or intent, and do not limit your mandatory rights as a consumer.

13. Changes to these terms

We may change these terms. Material changes are announced by email at least 30 days in advance, and you may cancel before the change takes effect. If you do not cancel, the new terms apply from that date.

14. Governing law and disputes

These terms are governed by Norwegian law. As a consumer you may complain to the Norwegian Consumer Authority, which mediates, and thereafter bring the matter before the Consumer Complaints Board. Legal venue is Oslo District Court, unless mandatory law provides otherwise.