VaultBox
Back
Your Privacy is Our Architecture

Privacy Policy

Effective Date: June 18, 2026  ·  Last Updated: June 18, 2026

Our Zero-Knowledge Promise

VaultBox is designed so that we cannot read your documents — ever. Your files are encrypted on your device before reaching our servers. We store only unreadable encrypted data. This is not a policy choice — it is an architectural fact.

1

Introduction

Welcome to VaultBox. This Privacy Policy explains how we handle your information when you use our encrypted personal document vault service (the “Service”).

By using VaultBox, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.

2

Information We Collect

Account Information

When you create an account, we collect your email address, your name (if provided), and account creation timestamps. Your login credentials are managed by our secure authentication provider — we do not store your login password directly.

Document Metadata — Not Contents

When you upload files, we store metadata only: file name and type, file size, upload date and time, and folder organization. We never store readable document contents. Your documents are always encrypted on your device before upload — we only receive the unreadable encrypted version.

Activity Logs

We maintain an activity log within your account recording actions such as uploads, downloads, folder changes, and vault lock/unlock events. These logs are visible only to you for full transparency and control.

Technical & Usage Data

We may automatically collect limited technical information: browser type, operating system, general geographic region (country level, not precise location), session timestamps, and anonymized error logs. We do not use cookies for advertising or behavioral tracking.

3

How We Use Your Information

PurposeData Used
Provide and operate the ServiceAccount info, metadata, activity logs
Authenticate your identityEmail, account credentials
Send essential account notificationsEmail address
Detect and prevent fraud or abuseTechnical and usage data
Improve Service reliabilityAnonymized error and performance data
Comply with legal obligationsAs required by applicable law

We never use your information for: advertising, marketing, sale to third parties, profiling, behavioral targeting, or AI training on your document contents.

4

Zero-Knowledge Architecture

  1. 1

    Your vault password never leaves your device

    It is used only in your browser to derive the encryption key.

  2. 2

    Encryption happens in your browser

    Before any data is sent to our servers.

  3. 3

    We store only encrypted ciphertext

    Our servers receive and store files that are mathematically scrambled and unreadable without your vault password.

  4. 4

    We cannot decrypt your files

    Even with full access to our own servers and databases, we cannot read the contents of your documents.

  5. 5

    No backdoors

    We have not built and will not build any mechanism to bypass your encryption.

5

Information Sharing & Disclosure

We do not sell, rent, or trade your personal information.

We may share limited information only in these circumstances:

Service Providers

Trusted third-party providers who help us run the Service (authentication, cloud storage, database). They act strictly as data processors under our instruction and are bound by confidentiality agreements. Note: our storage provider stores only encrypted files — they cannot decrypt them.

Legal Requirements

We may disclose account information if required by a valid court order, applicable law, or to protect the rights or safety of VaultBox or others. Regarding document contents — we cannot disclose what we cannot read. We will notify you of requests wherever legally permitted.

Business Transfer

If VaultBox is acquired or merges with another entity, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

6

Data Retention

Data TypeRetention Period
Account informationWhile account is active + 30 days after deletion
Encrypted document filesDeleted immediately upon your request or account deletion
Activity logs12 months rolling, or until account deletion
Technical/usage data90 days (anonymized after 30 days)
7

Your Rights & Choices

Access

Request a copy of the personal data we hold about you

Correction

Request correction of inaccurate account information

Deletion

Request deletion of your account and all associated data

Portability

Download your files at any time from your vault

Objection

Object to certain processing activities

Withdrawal

Withdraw consent where processing is based on consent

8

Children's Privacy

VaultBox is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has created an account, please contact us and we will promptly delete the account and associated data.

9

Changes to This Policy

When we make material changes, we will update the “Last Updated” date, send an email notification to registered users, and display a prominent notice in the app. Continued use of the Service after changes constitutes acceptance of the updated policy.

10

Contact Us

VaultBox Privacy Team

📧 privacy@vaultbox.app

We aim to respond to all requests within 5 business days.

© 2026 VaultBox. All rights reserved.