Privacy Policy

1. Zero-Knowledge Architecture

Cryphos is built on a "Zero-Knowledge" model. This means that we do not have access to your encryption keys, your master password, or the content of your secrets. All encryption and decryption happen locally in your browser.

2. Data We Collect

We collect minimal data necessary to provide the service:

• Account Information: Email address for account identification and recovery.
• Authentication Hashes: We store a salted hash of your authentication key, not your actual password.
• Encrypted Blobs: We store the encrypted data you upload (secrets, vault items). We cannot read this data.
• Audit Logs: Timestamps of actions (login, secret creation) for security monitoring.

3. Data Retention

Anonymous secrets are automatically destroyed based on your settings (after 1 view, or after a specific expiration time). Account data is retained as long as your account is active.

4. Third-Party Services

We use Sentry for error tracking (with data sanitization to remove any potentially sensitive fields) and MinIO for encrypted storage. Payments are handled via SBP.