Privacy Policy

What we collect

• Account metadata: Your email address and a hashed (bcrypt) version of your password verifier. We never store your plaintext password.
• Usage metadata: Timestamps of logins, storage usage totals, and session identifiers — the minimum required to run the service.
• Encrypted content: Your files, emails, calendar events, and vault entries — encrypted end-to-end. We cannot decrypt them.

What we never collect

• The plaintext content of any file, email, or password.
• Advertising identifiers, tracking pixels, or cross-site data.
• Your IP address beyond what is logged transiently by our servers for abuse prevention (purged within 30 days).

How we use your data

We use your email address solely to send you transactional emails (account notices, security alerts). We do not sell, rent, or share your data with third parties for marketing purposes.

Data location

All servers and backups are located in Canada. We do not transfer personal data outside of Canada. Our infrastructure partners are contractually required to comply with PIPEDA.

Your rights under PIPEDA

You have the right to access, correct, and delete your personal information. You may also withdraw consent at any time by deleting your account. For requests, contact [email protected].

Full details are available on our PIPEDA rights page.

Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). End-to-end encryption means even our staff cannot access your content. For details, see our security overview.

Cookies

We use only strictly necessary cookies for session management. No tracking or advertising cookies are used.

Changes

Material changes to this policy will be communicated by email at least 30 days in advance.