Privacy Policy

What we collect

We collect the minimum needed to run your account:

• Account information - your email address, account status, profile choices, and any optional master key hint you choose to save. A hint is readable account metadata, so it must never contain the master key itself. Supabase Auth handles your sign-in password; Velora Vault does not store the raw password in its application database.
• Encrypted vault contents - your passwords, documents, notes, cards, bank details, and technical credentials like SSH keys and API secrets, but only in encrypted form. See below for what this means in practice.
• Session and device metadata - sign-in timestamps and basic device information, used to keep your account secure and to detect suspicious activity.
• Contact form submissions - if you use the contact form, we collect the name, email address, topic, subject, and message you enter so we can respond to you.
• Analytics data - only if you accept the analytics cookie prompt, we collect basic usage data such as pages viewed, referring pages, and device/browser type through Google Analytics. See Analytics below.

How your vault is encrypted

Everything you save to your vault is encrypted with AES-256-GCM on your device before it is ever sent to our servers. The encryption key is derived from your master key using PBKDF2 with 600,000 iterations, and that master key is never transmitted to us, stored on our servers, or written to any log.

PIN and supported platform-authenticator unlock are optional, device-local convenience layers. They protect a local wrapper and recover the master key into memory for the active unlocked session; they do not replace the master key.

In practice, this means we store encrypted data we cannot read. We do not have the ability to decrypt your vault contents, view your passwords, or open your documents.

AI-assisted import is an explicit exception to local-only content processing: source text or images you select are sent to the configured processing service before reviewed results are encrypted and saved. See How security worksfor the full recovery and threat boundaries.

How we use your information

We use the information above only to:

• Create and confirm your account when you get started
• Authenticate you and maintain your session
• Enforce that only your own active account can access your data
• Detect and prevent abuse or unauthorized access
• Provide customer support when you contact us

We do not sell your information, and we do not use your vault contents for advertising, analytics, or model training - we cannot, since we cannot decrypt it.

Analytics

We use Google Analytics to understand how the marketing site is used - pages viewed, referring pages, approximate location, and device/browser type. This never includes your vault contents, master key, or anything you store inside the app, and it never runs on your unlocked vault pages.

Analytics is opt-in: it does not load until you accept the cookie prompt shown on your first visit. You can decline, and you can change your choice at any time by clearing your browser’s site data for veloravault.in, which resets the prompt.

Access control

Every request to your data is checked at the database level against your own account and its active status, not just whether you are signed in. If your access is suspended or revoked, your encrypted data becomes inaccessible even to our own systems in the normal course of operation.

Third-party services

We use a limited set of providers to operate Velora Vault:

• Supabase for authentication, account data, encrypted vault records, and avatar storage.
• Cloudflare R2 for encrypted document blobs. Documents are encrypted on your device before upload.
• Razorpay to process Plus subscriptions. Payment details are collected and handled by Razorpay, not stored in your vault database.
• Transactional email providers configured through Supabase Auth for account confirmation and security messages.
• Configured AI processing services only when you explicitly use AI-assisted import or categorization. The selected source material is sent for that requested operation.
• Google Analytics, only if you accept the analytics cookie prompt. See Analytics above for what this covers.

These providers do not receive your master key. Supabase and Cloudflare R2 store only encrypted vault content and cannot decrypt it without that key.

Data retention and deletion

We retain your account information and encrypted vault data for as long as your account is active. You can permanently delete your account and associated vault data from the Danger Zone in Settings. You may also contact us for help with a deletion request. Limited records may be retained where required by law.

Contact form submissions are retained so we can respond to your message and for a limited period afterward for support recordkeeping. Contact us using the details below if you’d like an earlier submission deleted.

Your rights

Depending on where you live, you may have the right to:

• Access the account information we hold about you
• Request a copy of your encrypted vault data
• Request correction of inaccurate account information
• Request deletion of your account and data

To exercise any of these rights, contact us using the details below.

Children’s privacy

Velora Vault is not directed at children, and we do not knowingly collect information from anyone under the age of 16.

Changes to this policy

We may update this policy as the service evolves. If we make material changes, we will update the date at the top of this page.

Contact us

Questions about this policy or your data can be sent to privacy@veloravault.in.