Privacy Policy

1. The Zero-Knowledge Promise

We cannot read your secrets. This is not a policy. It is a structural guarantee. Your secret is encrypted in your browser using AES-256-GCM. The encryption key (DEK) is placed in the URL fragment (the part after #), which browsers never transmit to the server. The server stores only ciphertext. Even if our database were compromised, your secret content would remain unreadable.

We have verified this structurally: our database roles are configured so that even the admin panel cannot read the ciphertext column. The admin DB role receives "permission denied" when attempting to access ciphertext, password hashes, or API key hashes.

2. Data We Collect

Account data: email address, scrypt-hashed password (we never see the plaintext), subscription tier, Stripe customer ID (if paid).

Secret metadata: creation timestamp, TTL, view count, IP address, user-agent, and referer for each view. This is for audit purposes only, never the secret content.

Admin audit log: every admin action (user lookup, moderation, bans) is logged with the admin's email, action type, target, and timestamp. This log is append-only (cannot be edited or deleted, enforced by a database trigger).

3. Data We Do NOT Collect

• Secret content (only ciphertext is stored; the key never reaches the server)
• Plain text passwords (only scrypt hashes)
• API key plaintext (only SHA-256 hashes)
• Recipient email addresses for OTP (only HMAC hashes)
• Browsing history or third-party tracking data

4. Cookies

We use a single session cookie (NextAuth) for authenticated users. No third-party tracking cookies. No advertising cookies. The cookie is HttpOnly, Secure, and SameSite=strict.

5. Data Retention

Secrets: destroyed when read (burn-after-read), when view limit is reached, when TTL expires, or when revoked. The ciphertext is physically removed (set to NULL). Metadata (audit trail) is retained for 12 months.

Backups: 7 daily + 4 weekly compressed database dumps. [TODO: confirm off-VPS backup storage before launch]

Account data: retained until you delete your account. When your account is deleted, all secrets you created are destroyed (ciphertext set to NULL, marked with reason "account_deletion"). Secrets shared TO you by others are not affected. Your personal data (email, account metadata) is removed. Audit metadata is retained for 12 months per the retention policy.

Support communications: If you use priority support (Team tier), your support messages are stored and visible to support staff. This is distinct from the zero-knowledge guarantee: support messages are NOT encrypted and the support team CAN read them. This is necessary to provide support and is standard for helpdesk systems. Support messages are append-only (cannot be edited or deleted).

6. Your Rights

You can: access your data via the dashboard, delete your account at any time (which destroys your secrets), export your full data (account metadata, audit trail, support history) as JSON via the dashboard. Secret content cannot be included in the export because the server never has it. For data deletion requests, contact support@jivu.sh.

7. Abuse and Moderation

Our admin team can: force-destroy reported secrets (ciphertext removed, reason logged), suspend accounts (login + creation blocked), ban IP addresses and email domains. All actions are audit-logged and cannot be deleted. The moderation team cannot read secret content; they can only see metadata.

8. Security Measures

AES-256-GCM encryption, PBKDF2 (600,000 iterations) for password-protected links, scrypt for password hashing, HMAC-SHA256 for recipient email verification, SHA-256 for token hashing, HTTPS enforced with HSTS, CSP headers, least-privilege database roles, append-only audit logging with hash-chain integrity.

9. Contact

[TODO: confirm contact address before launch] For privacy questions or data requests, contact support@jivu.sh.