Bitwarden
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
They cannot read your vault; they keep account data, use Google Analytics, and can close you without notice.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, encrypted vault contents, IP, device IDs, cookies, and site analytics.
Read the exact line
Privacy policy
“Bitwarden obtains Personal Information in connection with your account creation, usage of the Bitwarden Service and support, and payments for the Bitwarden Service such as names, emails address, phone”
Training
They run the service, support, billing, marketing you agreed to, and site analytics including Google Analytics.
Read the exact line
Privacy policy
“We use data for analytics and measurement to understand how the Site and Bitwarden Service are used. For example, we analyze data about your visits to our Site”
Sharing
Vendors who run hosting, billing, and email; also affiliates, partners, and legal requests.
Read the exact line
Privacy policy
“Bitwarden may also share your Personal Information with our affiliates and partners, to facilitate our global operations and in accordance with applicable laws”
Kept
Admin data while you are a customer; deleting the account is said to purge everything.
Read the exact line
Privacy policy
“We retain Administrative Data for as long as you are a customer of Bitwarden and as required by law.”
Controls
You can add, change, or delete vault items anytime and delete the whole account in Settings.
Read the exact line
Privacy policy
“We enable you to access, correct, and delete your account with the Bitwarden Service at any time.”
Fine print
They can close you without notice; service is as-is; you them; 30-day refunds on paid plans.
Read the exact line
Terms of service
“Bitwarden has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Delete your account in the web vault
Web vault Settings — simple delete option
Unsubscribe from marketing email
Unsubscribe link at the bottom of promotional emails, or Contact Us
Ask to opt out of some third-party sharing
Contact Us / privacypolicy@bitwarden.com
Opt out of Google Analytics
http://tools.google.com/dlpage/gaoptout
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can shut off your account for any reason and do not have to warn you first.
Read the exact line
Terms of service
“Bitwarden has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately.”
For example, you could lose access to your vault login without an email explaining why.
If someone sues them because of how you used the product, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to us, defend us, and hold us harmless from and against any and all claims, liabilities, and expenses, including attorneys' fees, arising out of your use of the Website and the Service”
For example, if a dispute over shared vault items leads to a lawsuit, you could be on the hook for their lawyers.
They do not promise the app will always work, stay up, or be error-free.
Read the exact line
Terms of service
“Bitwarden provides the Website and the Service "as is" and "as available," of any kind.”
For example, if the service is down when you need a password, they say they are not responsible.
A third-party analytics tool can connect your Bitwarden site visits with your activity elsewhere.
Read the exact line
Privacy policy
“When you visit the Site using Google Analytics, we and Google may link information about your activity from that site with activity from other sites that use Google Analytics services.”
For example, Google may tie your visit to the pricing page with visits to other sites that also use Google Analytics.
Account-related personal information can go to related companies and partners, not only core vendors.
Read the exact line
Privacy policy
“Bitwarden may also share your Personal Information with our affiliates and partners, to facilitate our global operations and in accordance with applicable laws”
For example, a partner helping with events or operations could receive your contact details.
They say they cannot read the passwords and files you store in the vault.
Read the exact line
Privacy policy
“Vault Data is encrypted using secure cryptographic keys under your control. Bitwarden cannot access Vault Data.”
For example, even Bitwarden staff should not be able to open your saved bank login.
Closing the account is meant to wipe your data, and you cannot get it back after that.
Read the exact line
Terms of service
“All information is purged from our databases when you cancel your account. Information cannot be recovered once your account is cancelled.”
For example, after you hit delete in Settings, they say the vault and account records are gone.
They say they do not sell California personal information under that law’s definition.
Read the exact line
Privacy policy
“We do not "sell" your Personal Information as we understand that term to be defined by the and its implementing regulations.”
For example, they claim they are not selling your email list to advertisers as a “sale.”
Paid plans can be refunded within 30 days if you contact them.
Read the exact line
Terms of service
“We offer a 30 day refund policy on all paid Services. If you would like a refund, please contact us and we will be more than happy to assist.”
For example, if you try Premium and cancel within a month, you can ask for your money back.
You must be at least 13; they rely on you stating your age, not a strong ID check.
Read the exact line
Terms of service
“You must be age 13 or older. While we are thrilled to see brilliant young people take an interest in our Service, we must comply with United States law.”
For example, a 12-year-old could still type a birth year and create an account until they notice.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
How we got here · grade B · score 51/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
Besides encrypted vault content, they collect account contact info, item counts, IP address, device identifiers, cookies, and site analytics.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body as biometric identifiers for the password manager.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
The site uses Google Analytics, which may link your Bitwarden visits with activity on other Google Analytics sites.
Do they sell or share your data, and can you opt out?
They say they do not sell under CCPA, but they share with vendors, affiliates, and partners, and you can contact them to opt out of some sharing.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete the account in web vault Settings; they say all information is then purged from their databases.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe AES-256 encryption on device, SSL in transit, and generally accepted security standards; no independent audit is detailed here.
Is there a real age gate, and are teens protected?
Users must be 13 or older; they will close under-13 accounts if they learn of them, with no extra age-check described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated April 2024; they say they will email or post notice of material changes, and terms give 30 days for material changes.
Can they close your account without warning, and can you get your data out first?
They may suspend or terminate access at any time, with or without cause, and with or without notice.
If something goes wrong, who pays?
The service is as-is with broad damage limits, and you must indemnify them for claims arising from your use.
Do subscriptions renew on their own, and can you get a refund?
Paid plans are billed in advance; you can change plans in Billing settings and they offer a 30-day refund if you contact them.
The privacy policy is 3,935 words at a professional or legal expert level (Flesch reading ease 2.8); the terms are 3,154 words at a college graduate level.
