Our Approach to Privacy
ZeyroVault is built on a simple belief: your data belongs to you. Every design decision starts from this principle. This policy explains what little information we collect, how we handle it, and what rights you have. We write it in plain language — because transparency matters when you're in the privacy business.
What We Don't Collect
- Your encryption keys or passwords — they stay on your device
- Your unencrypted content — we never see it
- Device fingerprints or unique identifiers
- IP addresses for tracking purposes — hosting and security logs are processed by our infrastructure provider (see Statistics & Hosting)
What We May Store
When you use our tools, the only thing that might reach our servers is already-encrypted data. Here's what that means:
- Data is encrypted with AES-256-GCM before it leaves your browser
- Encrypted data is stored without any identifying metadata attached
- We have no way to decrypt it — only you hold the key
- You can set expiration, and data is automatically deleted after that time
Technical Logs
To keep the service running reliably, our hosting provider (Cloudflare) keeps standard operational logs:
- Request timestamps and hosting logs processed by our infrastructure provider — never used to track you
- Error records for diagnosing issues
- Logs are not used to build profiles or identify individual users
Cookies and Local Storage
We keep cookies and local storage to a minimum and only use them where genuinely needed:
- Essential: Required for the site to work properly — these cannot be turned off
- Preferences: Remember your theme choice (light or dark mode) and language setting
- Statistics: Cookie-free aggregate analytics (Cloudflare Web Analytics) — off by default, no consent required
Statistics and Hosting
This site uses Cloudflare Web Analytics — a cookie-free, aggregate statistics service. It is off by default and only loads when we configure a deployment token. Aggregate statistics help us understand which pages are useful; they do not identify you and never include your encrypted content. The site is hosted on Cloudflare Pages, whose servers process standard request logs for security and operations.
- Cookie-free: no cookies, no fingerprinting
- Aggregate only: no personal data, no cross-site tracking
- Hosting logs: processed by Cloudflare for security and operations, not for tracking
Legal Basis for Processing
Under GDPR and similar regulations, we process any limited personal data on these grounds:
- Legitimate interest: Operating the website, ensuring security, and improving the service — in ways that do not override your privacy rights
- Consent: Only where we explicitly ask — current site statistics are cookie-free and do not rely on consent
- Legal obligation: Where required by applicable law
How Long We Keep Data
We don't hold onto data longer than necessary:
- Operational logs (processed by our hosting provider, not used for tracking): Up to 30 days
- Encrypted data: Until the expiration you set, or until you delete it
- Statistics data: Aggregate only; governed by Cloudflare's retention policy when enabled
Third-Party Services
We may use third-party services to support the site. These services operate under their own privacy policies:
- Cloudflare Web Analytics — cookie-free aggregate site statistics, off by default
- Advertising networks — planned for the future; not currently live
- Cloudflare Pages CDN — serves static assets and processes hosting logs
- We never share your encrypted content with any third party
Your Rights Over Your Data
Depending on where you live, privacy laws give you certain rights. Here's what you can expect:
- Be informed: You have the right to know what data we collect and why
- Access: Request a copy of any personal data we hold about you
- Correct: Ask us to fix inaccurate or incomplete information
- Delete: Request deletion of your personal data, unless we have a valid reason to keep it
- Restrict: Ask us to limit how we process your data in certain situations
- Portability: Get your data in a common, machine-readable format
- Object: Challenge processing based on legitimate interests or for direct marketing
- No automated decisions: We don't use profiling or automated decision-making that affects you legally
- Complain: Contact your local data protection authority if you have concerns
A note about your encrypted content: since we use zero-knowledge architecture, we cannot access, view, or decrypt anything you encrypt with our tools. You are in full control of access, expiration, and deletion.
To exercise any of these rights, please contact us at privacy@zeyrovault.com. We will respond within the timeframe required by applicable law.
Children's Privacy
Our tools are not designed for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us at privacy@zeyrovault.com and we will remove it promptly.
Data Breach Notification
In the unlikely event of a data breach involving your personal data, we will notify affected users and relevant authorities as required by applicable law, without undue delay. Due to our zero-knowledge architecture, encrypted content stored on our servers cannot be accessed or read by anyone without your encryption key — including in the event of a breach.
International Data Transfers
As a global service, limited operational data described in this policy may be processed in jurisdictions outside your country of residence. When such transfers occur, we ensure appropriate safeguards are in place — such as standard contractual clauses or equivalent mechanisms — to protect your data in accordance with applicable data protection laws.