Privacy policy

Last updated: October 2026

Who is responsible

Simon Franchi-Marchac, publisher of SAFE, is responsible for the processing described here. Contact: contact@online-safevault.com. This policy explains what is processed, why, by whom, for how long, and your rights under the GDPR.

The principle: we cannot read your vaults

Everything you put in a vault (passwords, cards, notes, files, keys) is encrypted on your device with AES-256-GCM before it is sent. The key comes from your vault password or code through Argon2id and never leaves your device. We, and the companies that host SAFE, only ever hold unreadable data. Nobody can reset a vault password: if you lose both the password and the recovery key, the vault cannot be opened again.

What we can see

Your account: email address, the name you give if any, and your account password (stored hashed by our authentication provider, never readable).
Your vaults: their names and the password hints you choose, which are stored as you type them so the list can be shown before a vault is opened. Avoid putting secrets in them.
About each item: its kind (password, card, note, file, key), the dates it was created, changed and deleted, whether it is a favorite, and the size of its files. Not its content.
Security: the sessions signed in to your account (IP address, browser or device description, dates), so you can see and close them; an identifier of each device you sign in from, to email you when a new one appears; one-time codes, stored hashed and valid for a few minutes; request counters to stop abuse.
Subscription: if you subscribe, your plan and the customer number given by Stripe. Card details are handled by Stripe and never reach us.
Messages: what you write to support by email or to the in-app assistant.

What stays on your device

Your preferences (text size, tabs, sorting), the list of things used recently, an encrypted copy of your vaults for use without a connection (in the app, sealed with a key that never leaves the device), Face ID or Touch ID, which is handled by your device and never accessible to us, and, only if you choose it on the website, a key that keeps a vault open after the tab closes for the time you set (it cannot be copied out of the browser). Reminders are scheduled on the device. None of this is sent to us.

Why, and on what basis

To provide the service you signed up for: account, sync of your encrypted data, security codes, subscription (performance of the contract).
To protect accounts: new-device alerts, session list, limits against abuse (legitimate interest).
To keep accounting records of payments (legal obligation).
To send occasional news about SAFE, only if you did not opt out, and you can stop them at any time from any email (consent).
We never sell your data, never use it for advertising, and never build profiles.

Who processes data for us

Supabase (accounts, database and file storage, servers in the European Union).
Netlify (hosting of the website files, United States).
Cloudflare (domain name and DNS; it also forwards emails sent to our contact address, which are then received in a Google Gmail inbox).
Brevo (sending emails, France).
Stripe (payments, Ireland and United States), only if you subscribe.
Anthropic (United States), only if you use the in-app assistant: your messages are sent to it to write the reply. The assistant never receives anything from your vaults, and we do not keep the conversation.
Have I Been Pwned (Australia): when you check for breaches, only the first five characters of a fingerprint (SHA-1 hash) of each password are sent, which cannot reveal the password; the list of breached websites is downloaded whole, so your websites are not sent.
Apple, if you use the iPhone app (App Store, and later in-app purchases).

Transfers outside the European Union

Some of these providers are in the United States or Australia. Where data leaves the EU, it does so under the safeguards the GDPR provides, such as the European Commission's standard contractual clauses or an adequacy decision. Your vault content, being encrypted, is unreadable wherever it is stored.

How long

Account and encrypted data: as long as your account exists.
Deleted items: kept 30 days in Recently deleted, then erased.
Shared links: 7 days at most.
One-time codes: a few minutes.
After you delete your account, everything is erased at once; copies may remain in encrypted backups for up to 7 days.
Payment records: as long as accounting law requires (10 years in France).

Security

End-to-end encryption, two-step sign-in, alerts on new devices, protection against repeated guesses, encrypted connections only, and strict access rules on every table. No system is perfect: if a breach ever affected personal data, we would tell the CNIL and, where required, you.

Your rights

You can access, correct, export and erase your data, restrict or object to its processing, and withdraw consent. From the app: export everything from Settings, Your data; delete your account from Account. For anything else: contact@online-safevault.com. You may also complain to the CNIL (cnil.fr).

Children

SAFE is not meant for children under 15 without a parent's agreement.

Changes

If this policy changes in a way that matters, you will be told in the app or by email before it applies.