Skip to main content

Privacy Policy

Effective Date: March 2026

BlinkVault ("we", "us", or "our") is committed to protecting your privacy. This policy explains what data we collect, why we collect it, and how you can control it.

1. Data We Collect

Account Data

When you create an account, we collect your email address, name (optional), and encrypted password (if you choose password auth). We also store OAuth tokens if you sign in with Google.

File Data

Files you upload are stored in Cloudflare R2 (EU/US region based on your location). Metadata (filename, size, MIME type, upload date) is stored in our database. AI-generated tags, categories, and summaries are stored alongside file metadata.

Usage Data

We collect standard server logs including IP addresses, request paths, and timestamps for security monitoring and abuse prevention. Logs are retained for 30 days.

2. Anonymous Demo Analysis

Our homepage offers an anonymous AI analysis demo. When you use this feature:

  • Your submitted text or file is sent to Google's Gemini AI API for analysis.
  • Your input is processed ephemerally and is not stored on our servers. It is discarded immediately after the AI analysis completes.
  • The AI-generated result (tags, category, summary) is stored temporarily in your browser's sessionStorage only if you choose to sign up and save it. sessionStorage is cleared when you close the browser tab.
  • No personal data (email, name, IP address) is associated with demo inputs.
  • We track only an aggregate daily count of demo uses (no per-IP or per-user tracking) to enforce a daily usage ceiling.

Google's use of data submitted via Gemini API is governed by Google's Privacy Policy. Under Gemini API terms, submitted data is not used to train Google's models.

Under the ePrivacy Directive, sessionStorage is considered strictly necessary for the service you requested and does not require cookie consent.

3. How We Use Your Data

  • To provide and improve the BlinkVault service
  • To send transactional emails (OTP verification codes, billing receipts)
  • To process payments via Stripe (we never store raw card data)
  • To detect and prevent abuse, fraud, and security threats
  • To comply with legal obligations

We do not sell your data. We do not use your files or their contents for advertising.

4. Third-Party Services

  • Cloudflare — CDN, DDoS protection, Workers runtime, R2 storage. Data may be processed on servers globally.
  • Google Gemini API — AI analysis of file content (opt-in per upload, anonymous demo).
  • Stripe — Payment processing. Stripe handles all card data under PCI DSS.
  • Google OAuth — Optional sign-in via Google account.

5. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

  • Access — Request a copy of all data we hold about you.
  • Rectification — Correct inaccurate data.
  • Erasure — Request deletion of your account and all associated data.
  • Portability — Receive your data in a machine-readable format.
  • Objection — Object to processing based on legitimate interests.

To exercise these rights, contact us at privacy@vaultica.io. We will respond within 30 days.

6. Data Retention

We retain your account data and files as long as your account is active. If you delete your account, all personal data and files are removed within 30 days. Server logs are retained for 30 days then automatically purged.

7. Security

Files are encrypted in transit (TLS) and at rest in Cloudflare R2. Passwords are hashed with bcrypt. We use HTTP-only, Secure cookies for session management. Access to production systems is restricted to authorized personnel only.

8. Changes to This Policy

We will notify registered users by email of any material changes to this policy at least 14 days before they take effect. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Questions? Contact us at privacy@vaultica.io

← Back to home