Privacy Policy

1. Who We Are

Vaultifier is an online diary and journal writing platform available globally at www.vaultifier.com. When this Privacy Policy refers to “Vaultifier”, “we”, “us”, or “our”, it means the operators of the Vaultifier platform.

For users in the European Union and United Kingdom, Vaultifier acts as the Data Controller of your personal data as defined under the General Data Protection Regulation (GDPR) and UK GDPR. For questions about your data, contact us at vaultifier@gmail.com.

2. What Data We Collect

2.1 Account Information

When you register, we collect:

• Your email address
• Your password (stored as a secure hash — we never store your plain-text password)
• Your account creation date and last login timestamp
• Your subscription status (Free or Premium)

2.2 Diary and Journal Content

Your diary entries, journal notes, vault names, and other content you write are stored on our servers in encrypted form.

In Zero-Knowledge mode, your content is encrypted on your device before it is sent to our servers. Your encryption keys remain under your control, and Vaultifier does not have access to the keys required to decrypt your content. We cannot read your encrypted content.

In Normal Security mode, your content is also encrypted on your device before being sent to our servers. However, the encryption keys are managed in a way that allows Vaultifier to decrypt your content when necessary to provide features and services that require server-side access. Although your content is encrypted while stored and transmitted, Normal Security mode is not zero-knowledge encryption.

We do not read, analyze, or use your diary or journal content for purposes unrelated to providing and operating the Vaultifier service.

2.3 Usage Data

We may collect limited technical data about how you interact with our platform, including:

• Your browser type and version
• Your device type and operating system
• Your IP address (used for security and fraud prevention, not for tracking or profiling)
• Pages visited and features used within the platform
• Error logs and performance data to help us improve the service

2.4 Payment Information

If you subscribe to our Premium plan, payment is processed by a third-party payment processor. We do not store your credit card number, expiry date, or full payment details. We retain only a record of your subscription status, billing date, and transaction ID for account management purposes.

3. How We Use Your Data

We use the data we collect to:

• Create and manage your Vaultifier account
• Store and deliver your encrypted diary and journal entries across your devices
• Process your Premium subscription and manage billing
• Send essential account communications including OTP verification, password resets, and security alerts
• Detect and prevent fraud, abuse, and security threats
• Improve the performance, stability, and features of our platform
• Comply with our legal obligations

We do not use your data for advertising. We do not build user profiles. We do not use your diary content to train machine learning models or AI systems. We do not sell your data to any third party, ever.

4. Zero-Knowledge Encryption and What It Means for Your Privacy

When you enable Zero-Knowledge mode, your encryption key is derived from your password on your device using PBKDF2 with 100,000 iterations and SHA-256, followed by HKDF-based key derivation. Your password and resulting master key remain on your device and are never sent to our servers. All encryption and decryption of your journal content happens locally on your device using the Web Crypto API with AES-GCM 256-bit encryption.

In this mode:

• We store only encrypted data and cryptographic key material that we cannot use to decrypt your content.
• We cannot decrypt or read your diary entries, journal notes, or other encrypted content.
• We cannot provide your decrypted content in response to a request or legal demand because we do not possess the encryption key required to decrypt it.
• If you lose your password or the recovery material required to access your encrypted data, Vaultifier cannot recover or decrypt your data for you.

Because Zero-Knowledge mode is designed so that Vaultifier does not have access to the keys required to decrypt your content, protecting your password and any recovery material is your responsibility.

5. How We Share Your Data

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

5.1 Service Providers

We work with trusted third-party providers to operate our platform, including cloud hosting, infrastructure, and payment processing. These providers are contractually required to process your data only on our behalf and in accordance with this Privacy Policy and applicable law.

5.2 Legal Requirements

We may disclose personal data if required to do so by law, court order, or government authority. In zero-knowledge mode, we cannot disclose your diary content because we do not hold the decryption key.

5.3 Business Transfers

In the event that Vaultifier is acquired, merged, or its assets are transferred, your data may be transferred to the acquiring entity. We will notify you in advance where required by applicable law. Before any such transfer, you may permanently delete your journal content, including your entries and vaults, through the available deletion options in the Service.

6. Data Retention

We retain your personal data for as long as your account remains active or as necessary to provide the Service, maintain security, comply with our legal obligations, resolve disputes, and enforce our agreements.

If you delete your account, your account and associated data are retained in a deleted state so that your account may be restored upon request and successful verification. Account deletion does not automatically result in the permanent deletion of all data.

You may permanently delete your journal content, including diary entries and vaults, using the available deletion options in the Service. Permanently deleted journal content cannot be restored.

Certain records, such as payment and transaction records, may be retained for as long as necessary to satisfy accounting, tax, legal, fraud-prevention, and other legitimate business requirements.

7. Cookies and Tracking

Vaultifier uses only essential cookies required to operate the platform, including authentication session cookies. We do not use advertising cookies, cross-site tracking cookies, or any cookies that profile your behaviour for marketing purposes.

We use Google Analytics and Vercel Analytics to understand aggregate platform usage — such as which pages are visited and how often — so we can improve the Service. These tools do not give us access to your diary or journal content, and your writing behaviour is not tracked or measured for commercial or advertising purposes.

8. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

8.1 For All Users

• Right of Access: You can access and export your diary and journal content through the available features in your account.
• Right to Deletion: You can delete your account at any time. Account deletion places your account into a deleted state and does not automatically permanently delete your account or associated data. You may permanently delete your journal content, including entries and vaults, using the available deletion options in the Service.
• Right to Portability: You can export your diary and journal content in JSON or HTML format using the available export features.
• Right to Correction: You can update your email address and other account information through your account settings, where those options are available.

8.2 For EU and UK Users (GDPR / UK GDPR)

In addition to the rights above, you have:

• The right to restrict or object to certain processing of your personal data
• The right to withdraw consent at any time where processing is based on consent
• The right to lodge a complaint with your national data protection authority

8.3 For California Users (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect and how it is used
• Opt out of the sale or sharing of personal information (we do not sell or share your data)
• Request deletion of your personal information
• Limit the use and disclosure of sensitive personal information, where applicable
• Not receive discriminatory treatment for exercising your privacy rights

To exercise any of these rights, please contact us at vaultifier@gmail.com. We will respond to all requests within 45 days.

9. Children’s Privacy

Vaultifier is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13 without the required parental consent, we will take reasonable steps to stop using the information and delete it where required by applicable law.

If you believe that a child under 13 has provided personal information to Vaultifier, please contact us at vaultifier@gmail.com.

10. Data Security

We take the security of your personal data seriously. Our security measures include:

• AES-GCM 256-bit encryption for encrypted diary and journal content
• PBKDF2 with 100,000 iterations and SHA-256 for key derivation in Zero-Knowledge mode
• HTTPS/TLS connections for data transmission
• OTP-based email verification for account access
• Access controls limiting which team members can access our infrastructure
• Security monitoring and measures designed to protect the Service and your data

No system is completely immune to security risks. In the event of a data breach that affects your personal data, we will notify you and the relevant authorities where required by applicable law.

11. International Data Transfers

Vaultifier operates globally and your data may be stored on servers located outside your country of residence. We ensure that any international transfer of personal data is carried out in accordance with applicable data protection law, including through the use of appropriate safeguards such as standard contractual clauses where required.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify you of any material changes by email or through a prominent notice on our platform at least 14 days before the changes take effect. The effective date at the top of this policy will always reflect when it was last updated.

13. Contact and Data Inquiries

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

• Email: vaultifier@gmail.com
• Website: www.vaultifier.com
• Response Time: We aim to respond to all data inquiries within 45 days