ZeyroVault Privacy Policy

Our Approach to Privacy

ZeyroVault is built on a simple belief: your data belongs to you. Every design decision starts from this principle. This policy explains what little information we collect, how we handle it, and what rights you have. We write it in plain language — because transparency matters when you're in the privacy business.

What We Don't Collect

• Your encryption keys or passwords — they stay on your device
• Your unencrypted content — we never see it
• Device fingerprints or unique identifiers
• IP addresses for tracking purposes — hosting and security logs are processed by our infrastructure provider (see Statistics & Hosting)

What Reaches a Server

The tools run entirely in your browser. Your input, passphrase and keys are never uploaded, so there is no server-side copy to store, expire or delete.

• No payload: text, files, passphrases and keys stay in browser memory.
• No account: there is no profile, login or user record to attach data to.
• Request metadata: Cloudflare processes standard request logs for security and operations.
• No content database: the service has no storage layer for encrypted files.

Technical Logs

To keep the service running reliably, our hosting provider (Cloudflare) keeps standard operational logs:

• Request timestamps and hosting logs processed by our infrastructure provider — never used to track you
• Error records for diagnosing issues
• Logs are not used to build profiles or identify individual users

Cookies and Local Storage

We keep cookies and local storage to a minimum and only use them where needed:

• Essential: Cloudflare may set security cookies required to serve and protect the site.
• Preferences: your theme choice and language setting are stored in your browser.
• Statistics: cookie-free aggregate analytics, off by default and no consent required on this site.

Statistics and Hosting

This site uses Cloudflare Web Analytics — a cookie-free, aggregate statistics service. It is off by default and only loads when we configure a deployment token. Aggregate statistics help us understand which pages are useful; they do not identify you and never include your encrypted content. The site is hosted on Cloudflare Pages, whose servers process standard request logs for security and operations.

• Cookie-free: no cookies, no fingerprinting
• Aggregate only: no personal data, no cross-site tracking
• Hosting logs: processed by Cloudflare for security and operations, not for tracking

Legal Basis for Processing

Under GDPR and similar regulations, we process any limited personal data on these grounds:

• Legitimate interest: Operating the website, ensuring security, and improving the service — in ways that do not override your privacy rights
• Consent: Only where we explicitly ask — current site statistics are cookie-free and do not rely on consent
• Legal obligation: Where required by applicable law

How Long We Keep Data

There is no server-side payload to retain. The only data with a retention period is operational metadata.

• Request logs processed by our hosting provider: up to 30 days.
• Preferences stored in your browser: until you clear site data.
• Statistics: aggregate only; governed by Cloudflare's retention policy when enabled.
• Encrypted files: never received, so no server-side retention period applies.

Third-Party Services

We rely on a small set of infrastructure providers. Each operates under its own privacy policy:

• Cloudflare Web Analytics — cookie-free aggregate site statistics, off by default.
• Advertising networks — planned for the future; not currently live.
• Cloudflare Pages CDN — serves static assets and processes hosting logs.
• We never receive your encrypted content, so there is nothing to share with a third party.

Your Rights Over Your Data

Depending on where you live, privacy laws give you certain rights. Here's what you can expect:

• Be informed: You have the right to know what data we collect and why
• Access: Request a copy of any personal data we hold about you
• Correct: Ask us to fix inaccurate or incomplete information
• Delete: Request deletion of your personal data, unless we have a valid reason to keep it
• Restrict: Ask us to limit how we process your data in certain situations
• Portability: Get your data in a common, machine-readable format
• Object: Challenge processing based on legitimate interests or for direct marketing
• No automated decisions: We don't use profiling or automated decision-making that affects you legally
• Complain: Contact your local data protection authority if you have concerns

A note about your encrypted content: the tools run in your browser, so we hold no encrypted content and no keys. The rights above apply to the limited personal data described in this policy, mainly request logs. Files you saved or shared remain under your control.

To exercise any of these rights, please contact us at privacy@zeyrovault.com. We will respond within the timeframe required by applicable law.

Children's Privacy

Our tools are not designed for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us at privacy@zeyrovault.com and we will remove it promptly.

Data Breach Notification

In the unlikely event of a breach involving our hosting or logs, we will notify affected users and relevant authorities as required by applicable law, without undue delay. A breach cannot expose your encryption keys or plaintext, because we never receive them.

International Data Transfers

As a global service, limited operational data described in this policy may be processed in jurisdictions outside your country of residence. When such transfers occur, we put appropriate safeguards in place, such as standard contractual clauses or equivalent mechanisms. Those safeguards protect your data in line with applicable data protection laws.