Legal

Privacy Policy

We believe privacy is a right, not a feature. This policy explains exactly how we handle your information.

Last updated: January 1, 2025

1. Overview

SecureVoult ("we", "our", "us") is a secure secret-sharing service. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. We are committed to handling your data with the utmost respect and transparency.

Our core principle is data minimisation: we store as little as possible, encrypt what we store, and delete it as soon as it has been viewed or has expired.

2. Data We Collect

Information you provide

We collect minimal information. When you use SecureVoult, we may receive:

  • Contact information — name and email address, only if you contact us directly
  • Usage metadata — secret configuration (expiry time, view limit) but never the content

Automatically collected data

Our application logs record only what is needed to keep the service running:

  • The request method and path, with secret, request and room identifiers removed and no query strings
  • HTTP status codes and response times
  • Error messages from the service itself

Application logs do not contain secret contents, decryption keys, passphrases or IP addresses, and are deleted after 7 days. Our hosting and network providers may keep their own technical logs under their own retention rules.

To enforce the monthly limit for guests without an account, we store a one-way hashed token derived from your IP address. It cannot be reversed to an address and changes every month. We never store the IP address itself with your secrets.

3. How Secrets Work

This section is particularly important for understanding SecureVoult's privacy model:

  • Encryption at rest — your secret is sent to our servers over HTTPS and encrypted with AES-256 before it is stored. Our servers decrypt it only to show it to the person who opens the link.
  • Temporary storage — encoded secrets are stored with a strict TTL (time-to-live). After expiry, they are permanently deleted.
  • Single access — once a secret is viewed the maximum number of times, it is immediately and permanently destroyed.
  • No logging of content — we do not log or analyze the content of secrets.
  • Passphrases — passphrases are stored only as one-way (bcrypt) hashes.

4. Cookies & Analytics

SecureVoult uses:

  • Essential cookies only — for session management and security
  • No advertising cookies — we do not use any advertising, tracking, or cross-site cookies
  • No third-party analytics — we do not use Google Analytics, Facebook Pixel, or similar tools

You can disable cookies in your browser settings. Core functionality will still work without cookies.

5. Third-Party Services

We do not sell, trade, or transfer your information to third parties. Limited sharing occurs only when:

  • Required by law or valid legal process
  • Necessary to protect our rights or prevent fraud
  • You explicitly request it

Our infrastructure partners (hosting providers) process data under strict data processing agreements and are prohibited from using your data for any other purpose.

6. Data Retention

We retain data for the shortest possible time:

  • Active secrets — until viewed the maximum times or until expiry, whichever comes first
  • Application logs — 7 days, then automatically deleted
  • Guest usage token — a hashed, monthly-changing token (never your IP address), kept with the secrets it counts
  • Contact form submissions — 90 days, then deleted
  • No indefinite storage — we do not maintain long-term databases of secret metadata

7. Your Rights

Depending on your location, you may have the following rights:

  • Right to access — request information about data we hold
  • Right to erasure — request deletion of your data
  • Right to portability — receive your data in a machine-readable format
  • Right to object — object to certain types of processing
  • GDPR / CCPA rights — if applicable, contact us to exercise these rights

To exercise any of these rights, contact us at support@SecureVoult.com.

8. Security

We implement industry-standard security measures including:

  • HTTPS/TLS encryption for all data in transit
  • Regular security audits and vulnerability assessments
  • Principle of least privilege for all internal access
  • Automated deletion of expired secrets

If you discover a security vulnerability, please report it responsibly to support@securevoult.com . We commit to responding within 48 hours.

9. Children's Privacy

SecureVoult is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Continued use of SecureVoult after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions or to exercise your rights, contact us: