Privacy Policy

1. Who we are

J-Vault is operated by Jameel Ahmed Siddiqui from Jahanian, Punjab, Pakistan ("J-Vault", "we", "us"). For any privacy question or request, use our contact page and choose the topic "Privacy and data".

2. What we can never see

The content of your records is encrypted in your browser before it reaches us, with keys that are created on your device and never sent to us. We cannot read your images, document titles, categories, person tags, notes or diary text, your 8 Recovery Kit words, or your encryption keys. We cannot reset your words or recover your data for you.

3. What we store

• Account: your username; if you use Google sign-in, your Google account ID and email address; the date you joined; the language of your Recovery Kit words; a one-way hash of a login key derived from your words (never the words themselves).
• Vault data: encrypted records and encrypted images; for each record its type (diary, book, medical or legal), its size, the time we received it, a salted fingerprint, its place in your hash chain and our signed receipt.
• Trusted devices: a random device ID, the device's public key, one half of a split secret, a hash of your PIN if you set one, and the time of last use.
• Evidence Packs: only what you choose to disclose when you issue a pack: reference codes, categories, stated dates, fingerprints and receipts, plus a fingerprint of the pack file and a payment reference. Anyone with the pack's link can see these details on its verification page.
• Billing: your plan status, the date your paid period ends, and what you send in an upgrade request (name, email, country and chosen payment method).
• Messages: what you send through the contact form: name, email address, topic and message.
• Security records: short-lived rate-limit counters keyed to a hash of your IP address (kept up to 24 hours) and server error logs.

4. How we use it

We use this data only to run J-Vault: to sign you in, store and return your encrypted records, issue receipts and timestamps, verify Evidence Packs, process your subscription, keep the service secure, answer your messages and meet legal obligations. We do not profile you, show you advertising or use your data to train AI models.

5. Legal bases

Where data protection laws such as the GDPR apply, we process your data to perform our contract with you (providing the service), for our legitimate interest in keeping the service secure and preventing abuse, with your consent where you choose Google sign-in, and to comply with legal obligations such as tax records for payments.

6. Services we use

• Google, if you choose Google sign-in. Google shares your account ID, name and email with us at your request.
• Your bank or mobile wallet provider (for example Taptap Send, JazzCash or Easypaisa) when you pay us; they process the payment under their own terms.
• OpenTimestamps calendars, which receive a single hourly hash (a Merkle root) built from many receipts. A hash reveals nothing about your records.
• Blockstream's public Bitcoin API, which we query for public block data to confirm timestamps. No personal data is sent.
• Our hosting provider, which stores the encrypted data and runs our servers.
• Email delivery for messages sent through the contact form and our replies.

We do not sell, rent or share personal data for advertising. If we receive a lawful demand for data, we can only provide what we hold, and your record content is encrypted with keys we do not have.

WordPress plugin (J-Vault Proof of Publication)

If you connect a blog with our WordPress plugin, we store the address of the blog, the Google email of the person who connected it, and for each stamped post its ID, public address, title, publish time and a SHA-256 fingerprint of its text. Backup copies of posts are encrypted on the blog before they are sent; the key is made from 8 words that stay with the blog owner, so we cannot read the copies. While connecting, our server makes one request to the blog to confirm that the request came from its dashboard. A public check page shows the blog address, the post address and the stamp dates to anyone who has the fingerprint of a post. To delete a blog's stamps and copies, write to us from the email that connected it.

7. Cookies and local storage

J-Vault uses one essential session cookie (sv_session) to keep you signed in and protect forms. There are no analytics, advertising or tracking cookies. On your own device, the app stores your language choice, the trusted-device keys (in IndexedDB) and, in the Vault Opener, a cache of key revocation checks. Clearing your browser data removes them.

8. How long we keep data

• Account and vault data: while your account exists.
• Encrypted images and original files: while your trial or subscription is active, and for 30 days after it ends (six months for student accounts). You can also remove server copies yourself after exporting a capsule.
• Deleted records: the content is wiped immediately; the receipt stays in your chain so your history remains consistent.
• Evidence Pack verification pages: kept so that packs you issued stay checkable, unless you ask us to remove them.
• Contact messages: up to 24 months.
• Rate-limit counters: up to 24 hours.

9. Your rights

You can export your full vault at any time from the app. You can correct titles and tags yourself. You can ask us to delete your account and associated data, to tell you what we hold about you, or to restrict or object to processing; we answer within 30 days. Depending on where you live, you may also complain to your data protection authority. If you are a California resident: we do not sell or share personal information as defined by the CCPA.

10. Security

Beyond end-to-end encryption, we use a strict Content Security Policy, HTTPS with HSTS, CSRF protection, rate limits, password-grade hashing of login keys and PINs, and signed receipts. No system is perfect. If we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

11. Children

J-Vault is not intended for children under 16, and we do not knowingly collect their data.

12. International use

J-Vault is used worldwide and our servers may be located in a country other than yours. Because your content is encrypted before it leaves your device, it stays unreadable wherever it is stored.

13. Changes

If we change this policy, we will update the date at the top. For significant changes we will also tell you in the app before they take effect.

14. Contact

Questions or requests: contact us. The free trial lasts 14 days and does not require payment details.