Privacy Policy

1. Who we are

The Secrets Vault is operated by FAHZY (Pty) Ltd. Our service is accessible at www.thesecretsvault.com. Our infrastructure is hosted on Amazon Web Services in the South Africa.

For any privacy-related questions or requests, contact us at enquiries@thesecretsvault.com.

2. Information we collect

Account information

When you register, we collect:

• Email address
• First name and last name
• Phone number (optional, provided at your discretion)

Payment information

When you start a subscription or free trial, payment is handled by PayFast, our South African payment gateway. Card details are entered directly on PayFast's secure, PCI-DSS-compliant systems, so we never see or store your full card number. We store a payment token (a reference that lets us charge your saved card), your subscription status, plan, billing dates and payment history for accounting and to operate your subscription.

Security credentials

We store a one-way authentication hash derived from your master password. Your master password itself is never transmitted or stored. We also store a key derivation salt, an encrypted vault key and recovery credentials. None of these allow us to decrypt your vault.

Encrypted vault data

We store the ciphertext of your vault, encrypted with AES-256-GCM in your browser before it is sent to our servers. We cannot decrypt it. We do not have access to your passwords, notes, usernames, or any other secrets you store.

Encrypted files

If you use the file storage feature, files are encrypted client-side before upload. We store only the encrypted bytes and basic metadata such as file size and MIME type. We cannot access the contents of your files.

Activity log

We maintain an activity log of vault actions (such as adding or deleting a secret) to help you monitor your account for unauthorised access. Log entries contain action names and item labels. They do not contain vault content.

Technical data

Our servers receive standard HTTP request data when you use the service, including your IP address and request timestamps. This data is used for security purposes such as detecting abuse and is not used for marketing or profiling.

3. Zero-knowledge architecture

The Secrets Vault is built on a zero-knowledge principle. Your master password is used locally in your browser to derive an encryption key through PBKDF2 with 250,000 iterations. That key never leaves your device. All encryption and decryption happens entirely in your browser using the Web Crypto API.

This means that even if our servers were compromised, your vault contents would remain protected. It also means we cannot recover your vault contents if you lose your master password and recovery code.

4. How we use your information

We use the information we collect to:

• Create and manage your account
• Verify your email address and authenticate you securely
• Send transactional emails such as email verification and security alerts
• Display your name and profile within the application
• Enable two-factor authentication if you choose to set it up
• Process your subscription and payments through PayFast and manage your plan and storage
• Detect and prevent abuse, fraud and security threats, including repeated free trials
• Respond to support and privacy enquiries

We do not use your data for advertising. We do not build profiles for marketing purposes. We do not sell your data to any third party.

5. Transactional emails

We send emails necessary to operate the service, including email address verification, security notifications and password reset assistance. These emails are sent via Amazon Web Services Simple Email Service (AWS SES) from no-reply@thesecretsvault.com. We do not send marketing or promotional emails.

6. Third-party services

We use the following third-party infrastructure providers. Each processes data only as necessary to provide the service and under contractual data processing agreements:

• Amazon Web Services (AWS) - Cloud infrastructure, hosting and email delivery. Data is stored in South Africa. AWS is certified under ISO 27001 and SOC 2.
• PayFast (Payfast (Pty) Ltd) - Payment processing for subscriptions. You enter your card details directly on PayFast's PCI-DSS-compliant systems; they receive your name, email and card data to process payments and share the payment result and a reusable payment token with us. See PayFast's own privacy policy for how they handle your card data.

We do not share your personal information with any other third parties, except where required to do so by law.

7. Data retention

Your account data is retained for as long as your account exists. You may delete your account at any time from within the application. When you delete your account, your personal information, encrypted vault data, encrypted files and activity logs are permanently deleted from our systems. Deletion is irreversible.

If you cancel a paid subscription, opt out during your free trial, or are removed from a family plan, we retain your encrypted account data for twelve months in case you decide to return. After twelve months it is permanently deleted. You can request immediate deletion at any time from within the application.

To enforce our one-trial-per-person policy and prevent abuse, we keep a one-way cryptographic hash derived from the email address of accounts that have used a free trial. This hash cannot be reversed to recover your email and it is retained even after account deletion solely to prevent repeated free trials.

Invoices, credit notes and payment records required for accounting, tax and legal compliance are retained for the period required by South African law, separate from your vault data. These documents survive account deletion and keep the billing details they were issued with: your name, email address and, where you supplied them, your company name, VAT number and billing address. They never contain anything from your vault.

Certain technical logs (such as server access logs) may be retained for up to 30 days for security and operational purposes before being automatically purged.

8. Your rights

Depending on where you are located, you may have rights under applicable privacy law, including:

• The right to access the personal information we hold about you
• The right to correct inaccurate personal information
• The right to delete your account and personal information
• The right to object to or restrict certain processing
• The right to data portability

South African residents have rights under the Protection of Personal Information Act (POPIA). European residents have rights under the General Data Protection Regulation (GDPR). To exercise any of these rights, contact us at enquiries@thesecretsvault.com.

Because of the zero-knowledge design, we are unable to provide you with the contents of your encrypted vault, as we cannot decrypt it. You can export your own data by decrypting it locally within the application.

9. Security

We implement appropriate technical and organisational measures to protect your personal information, including encrypted data transmission (TLS), encrypted storage, access controls and security monitoring. Your vault contents are protected by client-side encryption that we cannot bypass.

Despite our efforts, no system is perfectly secure. If you discover a security vulnerability, please report it responsibly to enquiries@thesecretsvault.com.

10. Cookies and local storage

The Secrets Vault does not use tracking cookies or advertising cookies. We use browser session storage to hold your session token and decrypted vault key for the duration of your browser session. This data is cleared when you close the browser tab or log out. No persistent cookies are set for authentication purposes.

11. Children

The Secrets Vault is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at enquiries@thesecretsvault.com and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of the page. For significant changes, we will notify you by email or by a notice within the application. Continued use of the service after any changes constitutes your acceptance of the updated policy.

13. Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at: