Privacy Policy

Last updated: 9 July 2026

KryVault is anonymous encrypted storage. This policy explains exactly what we can and cannot see. The short version: your files are encrypted on your own device before they ever reach us, so we hold only scrambled data we have no way to read.

We never ask for your name, email, or phone number. A randomly generated 28-character key is your entire account. We do not store that key, or anything that could be used to recreate it.

What we store on our servers

Encrypted file and note data (ciphertext). Encrypted in your browser with AES-256 before upload. We cannot decrypt it.
A one-way hash derived from your key, used only to look up the right vault. It cannot be reversed back into your key.
Sizes and timestamps of the encrypted blobs, so we can enforce your storage quota and expiry.

What we cannot see

Your vault key.
Your file names, note titles, or any file contents — these are encrypted too.
Anything that identifies you as a person.

What we do not do

No tracking, no analytics, no advertising, no cookies for profiling.
No third-party scripts. The site talks only to our own API.
No selling or sharing of data — there is nothing readable to sell.

Logs and abuse prevention

Our hosting provider may briefly process connection metadata (such as IP address) to deliver requests and block abuse, as any web service does. We use a rate limit to stop mass vault creation. We do not link this metadata to the contents of any vault, because we cannot read those contents.

Data retention and deletion

A free vault stays active for 90 days, followed by a 30-day read-only grace period so you can take your data out. After that, the encrypted data is deleted. You can delete any file, note, or your entire vault yourself at any time. Because we cannot identify you, deletion is done by you from inside the vault using your key.

Legal requests

If we receive a valid legal order, we can only ever hand over what we hold: encrypted blobs, their sizes, and timestamps. We have no key and no plaintext, by design. Specific unlawful content is removed when a valid order identifies it.

Changes to this policy

If this policy changes in a way that affects you, we will update the date above. Continued use of the service means you accept the current version.