Privacy Policy
Last updated: October 1, 2026
1. What we collect
We collect only what we need to run the service.
- Account details: your name, email address and a verifier derived from your passphrase. We never receive the passphrase itself.
- Billing details: handled by our payment processor. We keep the plan, billing country and the last four digits of your card for invoices; full card numbers never touch our systems.
- File metadata that the service requires: sizes, timestamps and sealed identifiers. File names and folder names are sealed on your device too, so we store them as ciphertext.
- Technical data: IP address, device and app version, and request logs, used for security and reliability.
- Messages to us: the contents of any email or support request you send.
2. How we use it
We use personal data to provide and secure the service, take payment, send notices you need (verification, security alerts, receipts), answer your questions, and fix problems. We rely on contract, legitimate interest and, where needed, consent as legal bases.
We do not sell personal data, show advertising, or use your stored files for analytics or to train any models. We can't — the contents are sealed.
3. Client-side sealing
Files, and the names of files and folders, are encrypted by the AuroVault app on your device with keys derived from your passphrase. Those keys are not sent to us. As a result, we cannot read your content, recover it if you lose your passphrase and recovery kit, or hand over readable content to a third party, even under compulsion.
Metadata we must see to operate — such as storage size, number of objects and access times — is described in section 1.
5. How long we keep it
- Account data: for as long as the account is open, then deleted within 30 days of closure.
- Stored files: until you delete them. Deleted files sit in the recovery shelf for up to 30 days and are then permanently removed; backups roll off within a further 35 days.
- Server logs: 45 days.
- Invoices and tax records: as long as the law requires, typically seven years.
6. Security
Beyond client-side sealing, data is encrypted in transit with TLS 1.3 and at rest on encrypted volumes. Access to production systems is limited, logged and protected by hardware keys. We commission independent penetration tests and fix findings promptly. If a breach affects you, we'll notify you and the relevant authorities within the timeframes the law requires.
7. Your rights
Depending on where you live (including under the GDPR, UK GDPR and CCPA/CPRA), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. Most of these can be done from your account settings. For anything else, write to privacy@aerovault.cc. You can also complain to your local data-protection authority.
9. International transfers
Your data is stored in the home region you choose for each space. Account and support data may be processed in the EU and the US by our providers. Where data moves between regions, we use approved safeguards such as Standard Contractual Clauses.
10. Children
AuroVault is not intended for anyone under 16. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
If we make material changes we'll email account holders and update the date at the top at least 14 days before they take effect.
12. Contact
Questions about privacy? Email privacy@aerovault.cc. For security reports, use security@aerovault.cc.