Privacy Policy

Our Approach to Privacy

ZeyroVault is built on a simple belief: your data belongs to you. Every design decision starts from this principle. This policy explains what little information we collect, how we handle it, and what rights you have. We write it in plain language — because transparency matters when you're in the privacy business.

What We Never Collect

• Your encryption keys or passwords — they stay on your device
• Your unencrypted content — we never see it
• Device fingerprints or unique identifiers
• IP addresses or location data

What We May Store

When you use our tools, the only thing that might reach our servers is already-encrypted data. Here's what that means:

• Data is encrypted with AES-256-GCM before it leaves your browser
• Encrypted data is stored without any identifying metadata attached
• We have no way to decrypt it — only you hold the key
• You can set expiration, and data is automatically deleted after that time

Technical Logs

To keep the service running reliably, our servers keep minimal operational logs:

• Request timestamps (no IP addresses stored)
• Error records for diagnosing issues
• No information that can identify individual users

Cookies and Local Storage

We keep cookies to a minimum and only use them where genuinely needed:

• Essential: Required for the site to work properly — these cannot be turned off
• Preferences: Remember your theme choice (light or dark mode) and language setting
• Analytics: Only activated with your consent, to help us understand how the site is used

Legal Basis for Processing

Under GDPR and similar regulations, we process any limited personal data on these grounds:

• Legitimate interest: Operating the website, ensuring security, and improving the service — in ways that do not override your privacy rights
• Consent: For analytics and any processing where we explicitly ask your permission
• Legal obligation: Where required by applicable law

How Long We Keep Data

We don't hold onto data longer than necessary:

• Operational logs (without IP addresses): Up to 30 days
• Encrypted data: Until the expiration you set, or until you delete it
• Analytics data: Governed by the respective provider's retention policy

Third-Party Services

We may use third-party services to support the site. These services operate under their own privacy policies:

• Analytics providers (e.g., Google Analytics) — help us understand site usage
• Advertising networks — support the site so we can keep tools free
• Content delivery networks — serve static assets efficiently
• We never share your encrypted content with any third party

Your Rights Over Your Data

Depending on where you live, privacy laws give you certain rights. Here's what you can expect:

• Be informed: You have the right to know what data we collect and why
• Access: Request a copy of any personal data we hold about you
• Correct: Ask us to fix inaccurate or incomplete information
• Delete: Request deletion of your personal data, unless we have a valid reason to keep it
• Restrict: Ask us to limit how we process your data in certain situations
• Portability: Get your data in a common, machine-readable format
• Object: Challenge processing based on legitimate interests or for direct marketing
• No automated decisions: We don't use profiling or automated decision-making that affects you legally
• Complain: Contact your local data protection authority if you have concerns

A note about your encrypted content: since we use zero-knowledge architecture, we cannot access, view, or decrypt anything you encrypt with our tools. You are in full control of access, expiration, and deletion.

To exercise any of these rights, please contact us at privacy@zeyrovault.com. We will respond within the timeframe required by applicable law.

Children's Privacy

Our tools are not designed for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us at privacy@zeyrovault.com and we will remove it promptly.

Data Breach Notification

In the unlikely event of a data breach involving your personal data, we will notify affected users and relevant authorities as required by applicable law, without undue delay. Due to our zero-knowledge architecture, encrypted content stored on our servers cannot be accessed or read by anyone without your encryption key — including in the event of a breach.

International Data Transfers

As a global service, limited operational data described in this policy may be processed in jurisdictions outside your country of residence. When such transfers occur, we ensure appropriate safeguards are in place — such as standard contractual clauses or equivalent mechanisms — to protect your data in accordance with applicable data protection laws.