Privacy Policy

1. Who we are

nvault ("nvault", "we", "us") is operated by [Your name], an independent developer based in Hyderabad, India. nvault is currently an independent project, not a registered company. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary; for the purposes of the EU/UK General Data Protection Regulation ("GDPR") we are the data controller for account data and the data processor for the file content you store.

Data-protection contact and point of contact for questions or complaints about our processing of your personal data: privacy@nvault.dev.

2. What we cannot see

• The plaintext contents of any file you store.
• Your vault passphrase, which is never transmitted to us.
• The key material required to decrypt your files.

Files reach our servers already encrypted and are stored only as ciphertext. See the security page for the full model.

3. Personal data we collect

• Account data: your email address, an optional display name, and a hashed account password.
• Vault metadata: project names, file names, version timestamps and sizes, and the wrapped (encrypted) keys needed for your own client to decrypt.
• Organization data (Team plan): organization name, membership list, roles, and the organization's public enrollment/roster keys.
• Session and device data: active browser sessions and CLI tokens, their creation and last-seen time, IP address and user-agent, so you can review and revoke them.
• Billing data: if you subscribe to a paid plan, a subscription identifier, plan, tier and status. Payment card details are collected and stored by our Merchant of Record (Polar), not by us — see the Refunds & Cancellation Policy.
• Audit records: timestamps and types of security-sensitive actions (login, key rotation, file deletion, membership changes). These never contain secret values.
• Operational logs: minimal request metadata for reliability and abuse prevention. We do not log environment variables, keys, tokens or passwords.
• Support correspondence: the content of emails you send us.

We do not use third-party analytics, advertising or tracking scripts. We do not buy or sell personal data.

4. Why we process it, and our legal basis

• To provide the service — authentication, storage, versioning, restore and organization management. Legal basis: performance of a contract (GDPR Art. 6(1)(b)); necessary for providing a service you requested (DPDP Act § 7).
• To secure accounts and prevent abuse — session management, rate limiting, audit logging. Legal basis: legitimate interests (GDPR Art. 6(1)(f)); legitimate use (DPDP Act).
• To take payment for paid plans. Legal basis: performance of a contract.
• To comply with law and respond to valid legal requests. Legal basis: legal obligation.
• To respond to your support requests. Legal basis: legitimate interests / consent.

5. Sub-processors and international transfers

We use a small number of infrastructure providers to host the application, store encrypted data, send transactional email and process payments. They act on our instructions under contractual security and confidentiality obligations and do not receive plaintext file contents or your passphrase. The current list is on the Sub-processors page.

Some providers are located outside India, the EU and the UK. Where personal data is transferred across borders it is protected by the provider's contractual commitments (including Standard Contractual Clauses where applicable) and by the fact that file content is transferred only as ciphertext.

6. Data retention

• Vault data (encrypted blobs and metadata) is retained while your account is active.
• Deleting a file, version, project or organization removes it from active storage. Encrypted backups roll off within 30 days.
• When you close your account we delete your vault data and account data within 30 days, except where we must retain limited records to comply with law, resolve disputes or enforce our agreements.
• Audit and security logs are retained for up to 12 months.
• Billing records are retained for the period required by applicable tax and accounting law.

7. Your rights

Subject to verification of your identity, you can:

• access the personal data we hold about you and get a copy;
• correct or update inaccurate data (much of this is editable in the app);
• delete your data by deleting projects and then your account, or by contacting us;
• export your data — you can download your files and their history at any time from the app;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing, and (GDPR) request data portability;
• nominate another individual to exercise these rights on your behalf in the event of death or incapacity (DPDP Act § 14);
• complain to a supervisory authority — the Data Protection Board of India, or your local EU/UK authority.

Because the vault is zero-knowledge, we cannot recover, produce or correct plaintext we never had. To exercise a right, email privacy@nvault.dev. We respond within 30 days.

8. California residents (CCPA/CPRA)

In the past 12 months we have collected the categories of personal information described in section 3 (identifiers, account and commercial information, internet activity limited to the service, and the contents of your communications with us). We do not "sell" or "share" personal information as those terms are defined by the CPRA, and we do not use sensitive personal information for purposes beyond providing the service. You have the right to know, delete, correct and limit, and not to be discriminated against for exercising those rights.

9. Children

nvault is a developer tool and is not directed at children. We do not knowingly process the personal data of anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

10. Security

We apply reasonable security practices and procedures as required by the SPDI Rules, 2011 and the DPDP Act: client-side AES-256-GCM encryption, a server-side envelope-encryption layer, hashed passwords, scoped access tokens, least-privilege authorization checks on every request, and audit logging. No system is perfectly secure; you are responsible for your account credentials and your vault passphrase.

11. Breach notification

If a personal data breach affecting you occurs, we will notify you and the Data Protection Board of India (and other regulators where required) without undue delay and in line with applicable law.

12. Changes

We may update this policy as the product evolves. Material changes will be announced in the app or by email, and the effective date above will change.

13. Contact

Privacy questions: privacy@nvault.dev. Operated from Hyderabad, Telangana, India. If you require a postal address for a formal legal notice, request one at that email and we will provide it.