Draft for the preview build
Last updated 2026-11-07
This agreement is between you and [the person or company that runs Soren] ("we"). It covers using Soren: the website, the desktop app and the service behind them. By creating an account or using the desktop app, you agree to it. If you don't agree, please don't use Soren.
Soren is still being built. Its encryption hasn't had an independent security review yet. Please don't store passwords or secrets you can't afford to lose or have exposed until it has. Features may change, break or be removed, and we may need to reset accounts while Soren is in preview (we'll warn you first if we can).
We give you a personal, free, non-exclusive right to use Soren, including installing the desktop app on your own devices. Don't sell access to Soren, or copy or change it to pass it off as your own. If we publish Soren's source code under an open-source licence, that licence covers the code; this agreement still covers using our service.
Your vault is encrypted on your device with a master key that Soren makes for you and never sees. Keep your master key and your Emergency Kit (with its recovery code) safe and private. If you lose both, nobody, including us, can open your vault or get your data back. That's how Soren keeps your data private, not something we can override.
You sign in with a passkey, or by approving a new device from one that's already signed in. Keep your devices locked and up to date, and only approve devices you're holding yourself. You're responsible for what happens in your account and for anything you store or share with Soren.
Don't use Soren to break the law, store or share illegal content, harm others, send spam or malware, overload the service, or try to get into other people's accounts or data. Don't use send links or the website-icon feature to attack other services. Security research is welcome if you follow our security policy (SECURITY.md).
A send link lets anyone who has it open what you shared, until it expires or runs out of views. Only send links to people you trust, over channels you trust. Once someone has opened it, we can't take it back from them.
You can attach photos to items, encrypted on your device. Storage is limited (currently 100 MB per vault and 10 photos per item) so Soren can stay free. Only upload pictures you have the right to store.
The breach check sends the first 5 characters of a scrambled (hashed) version of each password, through our server, to Have I Been Pwned, which can't work out the password from it. If website icons are on, our server fetches each site's icon from that site. These services have their own terms.
The desktop app opens Soren in its own window and adds features like hiding Soren from screen capture, a menu-bar icon and opening at login. Screen-capture hiding depends on your operating system and may not stop every app. The app may check for and offer updates.
Our privacy policy explains what we can and can't see. In short: we can't read your vault. You can export your vault at any time, and you can ask us to delete your account. When an account is deleted, its encrypted data is removed from our live systems; backups expire on their own schedule.
Soren is provided "as is" and "as available". As far as the law allows, we don't promise that it will be error-free, always available, or free of security flaws, or that it will meet your needs. Keep your own backups (an encrypted export is a good one).
As far as the law allows, we aren't liable for indirect or consequential losses, or for loss of data, accounts, profits or access to other services, including losses caused by a lost master key, a compromised device, or a security flaw. Since Soren is free, our total liability to you is limited to [an amount, such as USD 50]. Some places don't allow these limits, so they may not all apply to you.
You can stop using Soren at any time; export your vault first and ask us to delete your account. We may suspend or close accounts that break this agreement or put others at risk, and we may shut Soren down. If we shut it down, we'll try to give you at least 30 days' notice so you can export your vault.
We may update this agreement as Soren develops. If a change matters, we'll tell you in the app and ask you to accept it again. If you don't accept, you can export your vault and stop using Soren.
This agreement is governed by the laws of [your country and state], except where the law where you live says otherwise. Questions: [contact email]. Security reports: see SECURITY.md.
Draft for the preview. Written in plain language, not reviewed by a lawyer yet. Items in [brackets] must be filled in before a public launch.
Back to soren.locker