Privacy Policy

1. Overview

TesseraVault ("we," "our," or "us") is a zero-knowledge encrypted document collection platform. This Privacy Policy explains how we collect, use, and protect your information when you use our service at tesseravault.com.

2. Zero-Knowledge Architecture

TesseraVault is designed so that we cannot access the contents of your documents. All files are encrypted on the client device before being transmitted to our servers. Encryption keys are derived from your passphrase, which is never sent to or stored on our servers. We store only encrypted data and encrypted key material.

3. Information We Collect

We collect the following information:

• Account information: Name, email address, and hashed password when you create an account.
• Encrypted data: Client-encrypted documents, encrypted private keys, and associated metadata (file names, sizes, MIME types).
• Usage data: IP addresses, browser user agents, timestamps for audit logging and security purposes.
• Billing information: Payment details are processed and stored by Stripe; we store only your Stripe customer ID and subscription status.

4. How We Use Your Information

• To provide, maintain, and improve our service.
• To process transactions and manage billing.
• To send transactional emails (account verification, security alerts).
• To maintain audit logs for security and compliance.
• To enforce our terms of service and protect against abuse.

5. Third-Party Services

We use the following third-party services:

• Stripe for payment processing.
• Resend for transactional email delivery.
• Backblaze B2 for encrypted file storage.
• Neon for database hosting.
• Railway for application hosting.

These services only receive the minimum information necessary. Backblaze B2 stores only encrypted file data that cannot be decrypted without your private key.

6. Data Retention

We retain your account data for as long as your account is active. Encrypted documents are retained according to the expiration settings of each document request. You may request deletion of your account and all associated data at any time by contacting us.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction or deletion of your personal information.
• Export your data in a portable format.
• Object to or restrict certain processing activities.

8. Security

We employ industry-standard security measures including TLS encryption in transit, AES-256-GCM encryption at rest (client-side), RSA-4096 key wrapping, rate limiting, and comprehensive audit logging. Our zero-knowledge architecture ensures that even in the event of a data breach, your document contents remain protected.

9. Cookies

We use essential cookies for authentication and session management. We do not use tracking cookies or third-party analytics.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email to the address associated with your account.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].