Privacy Policy
Effective Date: June 18, 2026 · Last Updated: June 18, 2026
Our Zero-Knowledge Promise
VaultBox is designed so that we cannot read your documents — ever. Your files are encrypted on your device before reaching our servers. We store only unreadable encrypted data. This is not a policy choice — it is an architectural fact.
Introduction
Welcome to VaultBox. This Privacy Policy explains how we handle your information when you use our encrypted personal document vault service (the “Service”).
By using VaultBox, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.
Information We Collect
Account Information
When you create an account, we collect your email address, your name (if provided), and account creation timestamps. Your login credentials are managed by our secure authentication provider — we do not store your login password directly.
Document Metadata — Not Contents
When you upload files, we store metadata only: file name and type, file size, upload date and time, and folder organization. We never store readable document contents. Your documents are always encrypted on your device before upload — we only receive the unreadable encrypted version.
Activity Logs
We maintain an activity log within your account recording actions such as uploads, downloads, folder changes, and vault lock/unlock events. These logs are visible only to you for full transparency and control.
Technical & Usage Data
We may automatically collect limited technical information: browser type, operating system, general geographic region (country level, not precise location), session timestamps, and anonymized error logs. We do not use cookies for advertising or behavioral tracking.
How We Use Your Information
| Purpose | Data Used |
|---|---|
| Provide and operate the Service | Account info, metadata, activity logs |
| Authenticate your identity | Email, account credentials |
| Send essential account notifications | Email address |
| Detect and prevent fraud or abuse | Technical and usage data |
| Improve Service reliability | Anonymized error and performance data |
| Comply with legal obligations | As required by applicable law |
We never use your information for: advertising, marketing, sale to third parties, profiling, behavioral targeting, or AI training on your document contents.
Zero-Knowledge Architecture
- 1
Your vault password never leaves your device
It is used only in your browser to derive the encryption key.
- 2
Encryption happens in your browser
Before any data is sent to our servers.
- 3
We store only encrypted ciphertext
Our servers receive and store files that are mathematically scrambled and unreadable without your vault password.
- 4
We cannot decrypt your files
Even with full access to our own servers and databases, we cannot read the contents of your documents.
- 5
No backdoors
We have not built and will not build any mechanism to bypass your encryption.
Information Sharing & Disclosure
We do not sell, rent, or trade your personal information.
We may share limited information only in these circumstances:
Service Providers
Trusted third-party providers who help us run the Service (authentication, cloud storage, database). They act strictly as data processors under our instruction and are bound by confidentiality agreements. Note: our storage provider stores only encrypted files — they cannot decrypt them.
Legal Requirements
We may disclose account information if required by a valid court order, applicable law, or to protect the rights or safety of VaultBox or others. Regarding document contents — we cannot disclose what we cannot read. We will notify you of requests wherever legally permitted.
Business Transfer
If VaultBox is acquired or merges with another entity, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | While account is active + 30 days after deletion |
| Encrypted document files | Deleted immediately upon your request or account deletion |
| Activity logs | 12 months rolling, or until account deletion |
| Technical/usage data | 90 days (anonymized after 30 days) |
Your Rights & Choices
Access
Request a copy of the personal data we hold about you
Correction
Request correction of inaccurate account information
Deletion
Request deletion of your account and all associated data
Portability
Download your files at any time from your vault
Objection
Object to certain processing activities
Withdrawal
Withdraw consent where processing is based on consent
Children's Privacy
VaultBox is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has created an account, please contact us and we will promptly delete the account and associated data.
Changes to This Policy
When we make material changes, we will update the “Last Updated” date, send an email notification to registered users, and display a prominent notice in the app. Continued use of the Service after changes constitutes acceptance of the updated policy.
Contact Us
VaultBox Privacy Team
📧 privacy@vaultbox.app
We aim to respond to all requests within 5 business days.
© 2026 VaultBox. All rights reserved.