Privacy Policy

1. Overview & quick summary

VaultMorph AI Shield is a privacy-first application. Its core function — sanitizing sensitive data before it leaves your device — means the product is architecturally designed to process as little personal data as possible.

2. Who we are

Data Controller: VaultMorph (operating under vaultmorph.org)
Contact: contact@vaultmorph.org
Data deletion requests: contact@vaultmorph.org or via GitHub Issues

3. Data collected by edition

Your prompts, sanitized tokens, API keys, and conversation history are processed and stored exclusively on your device. None of this data is sent to VaultMorph servers at any time, in any edition.

4. What we collect (Pro Trial)

4.1 Email address

Collected when you activate a Pro Trial license. Used solely to issue and identify your license JWT. We do not use your email for marketing unless you explicitly opt in (we currently have no marketing programme).

4.2 Device hash

A one-way SHA-256 hash of non-identifying hardware identifiers (hostname, OS identifiers). This hash cannot be reversed to identify you or your machine. It is used to prevent a single trial license being activated on an unlimited number of devices.

4.3 License metadata

Issue date, expiry date, and edition. Stored server-side to allow license renewal and revocation.

4.4 What we never collect

• Your prompts or conversations
• The secrets or tokens you sanitize
• Your API keys
• IP address (not logged beyond standard nginx access logs, retained for 7 days only)
• Payment or financial information (the Pro Trial requires no payment)
• Browser fingerprints, cookies, or behavioural analytics

5. Legal basis for processing (GDPR Article 6)

6. Data storage & international transfers

Pro Trial data (email address, device hash, license metadata) is stored on servers located in India — OCI Mumbai region, operated by Oracle Cloud Infrastructure.

If you are in the EU/EEA: Your data is transferred to and processed in India, which is outside the EU/EEA and does not currently hold an EU adequacy decision. This transfer is made under Article 49(1)(b) GDPR — the transfer is necessary for the performance of a contract entered into at your request (license activation). We collect the minimum data necessary for this purpose. If you have concerns about this transfer, you may contact us at contact@vaultmorph.org, or choose the Community edition, which requires no data submission and makes no network connection to our servers.

If you are in India: Your data is stored domestically in the OCI Mumbai region. No cross-border data transfer occurs. Processing is on a contractual necessity basis under the DPDP Act 2023. You may request deletion at any time (see Section 10).

Community and Enterprise editions: No data is transmitted to our servers; no transfer occurs.

7. Data sharing

We do not sell, rent, or share your personal data with any third party.

The only sub-processor is Oracle Cloud Infrastructure (OCI), which provides the server infrastructure in Mumbai, India. OCI processes data solely as a hosting provider and is bound by data processing agreements.

We may disclose data if required by law or court order, but will notify you to the extent permitted by law before doing so.

8. Data retention

To request earlier deletion, email contact@vaultmorph.org with subject line "Data Deletion Request" or use GitHub Issues. We will confirm deletion within 30 days.

9. Your rights — GDPR (EU / EEA / UK)

If you are in the EU, EEA, or UK, you have the following rights under the GDPR:

• Right of access (Art. 15) — request a copy of data we hold about you
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion ("right to be forgotten")
• Right to restriction (Art. 18) — restrict how we process your data
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to lodge a complaint — with your national supervisory authority (e.g. your country's Data Protection Authority)

Exercise any right by emailing contact@vaultmorph.org. We will respond within 30 days (extendable to 90 days for complex requests with notice).

10. Your rights — India DPDP Act 2023

If you are a data principal in India under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right to information — know what personal data we process and for what purpose
• Right of access — obtain a summary of personal data processed
• Right to correction and erasure — correct inaccurate or incomplete data, or request erasure
• Right to grievance redressal — raise a grievance and receive a response within 48 hours
• Right to nominate — nominate another individual to exercise rights in the event of death or incapacity

To exercise these rights or raise a grievance, contact our Data Protection Officer: contact@vaultmorph.org. We will respond within 48 hours for acknowledgment and within 30 days for resolution.

If your grievance is unresolved, you may escalate to the Data Protection Board of India once it is constituted and operational.

11. Cookies & analytics (website)

vaultmorph.org currently uses no analytics, tracking scripts, or third-party cookies. Only a strictly necessary session cookie may be set if you visit an authenticated page (e.g. license management). We do not use Google Analytics, Meta Pixel, or any behavioural tracking.

12. Security measures

• Data in transit: TLS 1.2+ enforced on all API endpoints
• Data at rest: encrypted at the OCI storage layer (AES-256)
• License JWTs: signed with Ed25519 — tamper-evident and verifiable offline
• API keys (on your device): AES-256-GCM, stored in OS keychain (Windows Credential Manager / macOS Keychain)
• No raw secrets are transmitted to our servers in any scenario

To report a security vulnerability, see our Security Policy.

13. Children's privacy

VaultMorph AI Shield is not directed at children under 13 (or under 18 in jurisdictions where applicable). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately and we will delete it.

14. Changes to this policy

We may update this policy as the product evolves. When changes are material, we will update the "Last updated" date at the top of this page and, where feasible, notify Pro Trial users by email at least 14 days before the change takes effect. Continued use of the application after that date constitutes acceptance of the updated policy.

15. Contact & DPO

Email: contact@vaultmorph.org
Subject line for privacy requests: "Privacy Request — [your request type]"
GitHub Issues: github.com/NitinChauhan22/VaultMorph_AI_Shield_Chat_Public/issues

Response time: acknowledgment within 48 hours, resolution within 30 days.