Privacy policy

Your passphrase, the readable title, and the readable message are encrypted in your browser. They are not sent to the server, and they are not included in email. If the passphrase is lost, the message cannot be restored from the stored ciphertext.

A file is encrypted in the browser before upload. CipherSwitch cannot open it, scan it, or tell a document from a harmful program. Using the service to distribute malware is prohibited. The email a recipient receives warns that a file may be unsafe and that they should not open it unless they trust the sender.

When you create a vault, the service stores:

• the encrypted title and encrypted message, plus the salt, initialization vectors, and integrity check
• the owner email address and each recipient’s email address and role
• SHA-256 hashes of the check-in token, the dashboard token, and any unlock token
• schedule details such as the check-in interval, grace period, travel window, release time, template name, and whether the vault is a dry run
• status, including when it was created, last checked in, or triggered

Check-in and unlock tokens are emailed in links. The dashboard token is a separate code, emailed to the owner and shown on the seal confirmation. The email address is not that code. The database keeps the hashes, not the tokens themselves.

The service uses that information to:

• keep the vault and show it on the dashboard that matches your access token
• send check-in, reminder, release, and witness emails
• decide when a vault enters a grace period or triggers
• refuse an unlock until the vault has triggered and any release delay has passed
• operate, secure, and debug the service

Email addresses are used because you asked the service to contact those people about that vault. The service does not sell personal information and does not use it for advertising.

Transactional email is sent through Resend when an API key is configured. Resend receives the recipient address, the subject, and the message, which includes vault links. Resend’s own terms and privacy notice apply to that delivery. If no email key is configured, those messages are not sent.

One-time payments are processed by Stripe. Stripe receives the card details and the billing details the payer enters. CipherSwitch stores the checkout id, the kind of purchase, and the vault it was used for. It does not store the card number.

Check-in, unlock, and dashboard tokens are placed in the address hash, which browsers do not send to the server with the page request. The token is sent only when you submit it, for example to check in or to unlock. Server logs can include an email address when a message is sent, and they can include ordinary request data needed to run the API.

Accessibility choices are saved in local storage on your device under the key cipherswitch-a11y. They are not sent to the server. The site does not set advertising cookies and does not run a third-party analytics tracker.

The owner can delete a vault from the dashboard with the dashboard code. Deletion removes the ciphertext and the stored email addresses for that vault. It cannot erase a message already delivered to an inbox, and it cannot undo a file a recipient already downloaded. The operator of this deployment can also remove a vault from the database they control.

Data is shared with the email provider when email is enabled, and with people you named when the service sends them a link or a notice. It can also be shared if the law requires the operator to disclose it. The operator does not otherwise hand the vault database to other companies.

CipherSwitch is for adults. It is not directed at anyone under 18, and it should not be used to collect information about a child.

You can stop using the service, stop checking in, and avoid sending further email addresses. Depending on where you live, you may have rights to access, correct, or delete personal information, or to object to certain uses. Those requests are made to the operator of the CipherSwitch deployment you used, because this software does not publish a separate company address.

Where the European data-protection rules apply, the operator of that deployment is the controller of the owner and recipient email addresses and of the vault records. The legal bases relied on are the steps you asked the service to take before a contract is in place, the contract formed by these terms, and the operator’s legitimate interest in keeping the service secure and running.

If this notice changes, the updated version will replace this page and the date at the top will change.