Privacy policy
What we collect, why, who else handles it, and how long we keep it.
- We cannot read your files, file names, folder names or vault names. They are encrypted on your device.
- We keep your email address, your plan, your sign-ins and the encrypted data.
- No ads, no trackers, and we do not sell data.
1Who we are
Stonesafe is run by [legal entity], [registered address] ("we", "us"). We decide how the personal data in this policy is used, which makes us the controller under the EU General Data Protection Regulation (GDPR). This policy covers the Android app, the web app at my.stonesafe.app, share-link pages and this website.
2What we cannot see
Your files, file names, folder names, vault names and the contents of share links are encrypted on your device before they reach us. Vault passwords, your account password and recovery keys never leave your device. We do not hold the keys and cannot decrypt your vaults: not for you, not for us, and not for anyone who asks us.
3What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in and send account, billing and security emails, and the link emails you turn on. | Contract |
| Sign-in record | A keyed hash of a login key made from your password, and your home vault's encrypted header, so you can sign in on a new device. Neither one reveals the password. | Contract |
| Plan and payments | Plan, storage limit, payment status, and the payment company's customer and subscription IDs. | Contract; tax law for billing records |
| Sign-ins | For each device or browser: the app, the browser and system name, when it signed in and when it was last used. You can see and end them in Settings. | Contract; account security |
| Encrypted data | Vault IDs, encrypted files and indexes, their sizes and times, and which vaults belong to your account, to store them and count them against your plan. | Contract |
| Email change | When you change your address: the new address and, while a change waits up to 7 days, the waiting change. We email the old address so you hear of it. | Contract; account security |
| Live note changes | While a vault is open on several devices, note changes pass through our server to the other devices. They are encrypted on your device, and we do not store them. | Contract |
| Folder backup | A hash of the token that lets a phone add files to one vault's inbox, and the encrypted files it sent. Which phone folder it watches stays on the phone. | Contract |
| Share links | Link ID, size, end time, a hash of the link's open key if it has a password, and the time of each download. No address and no browser. | Contract |
| Export links | When you choose Email me a link: the link ID, its end time, which vault it belongs to, the vault header locked with the vault password, the list of what goes sealed with the vault key, and, for a vault with no cloud copy, encrypted copies of its files. | Contract |
| IP addresses | To count requests and stop abuse. Our servers keep these counts in memory only and do not write IP addresses to disk. Cloudflare, which carries our traffic, sees them (section 5). | Legitimate interest in security |
| Your messages | To answer when you write to us. | Legitimate interest |
We do not use your data for advertising or profiling, and we do not sell it.
4Cookies and browser storage
This website sets only its own cookies: one keeps you signed in, one remembers light or dark if you choose, one lasts two minutes while a sign-in passes from the web app, and one remembers that you signed out. It sets no tracking cookies and loads nothing from other sites.
The web app sets no cookies. It keeps your settings and your sign-in in the browser's storage. The keys of open vaults are kept, sealed, only for the tab they are open in.
The apps contain no third-party analytics or advertising code.
5Other companies that handle data
Each company gets only what its job needs.
| Company | What for | Where | What it handles |
|---|---|---|---|
| Hetzner Online | Servers, file storage, database backups | Helsinki, Finland; backups in Falkenstein, Germany | Encrypted files; our database, and its backups, which are encrypted |
| [second storage company] | A second copy of encrypted files | [country] | Encrypted files with random names |
| Cloudflare | Domain, network protection, forwarding of our email addresses | Global; US company | IP addresses and the requests that pass through; emails you send us |
| Resend | Sending email | United States | Your email address and the emails we send you |
| Dodo Payments | Card payments on this website, as merchant of record | [country] | What you enter on their payment page, and your email address |
| Subscriptions bought in the Android app, through Google Play | United States | Your purchase, under Google's own policy | |
| BTCPay Server, run by us | Bitcoin payments | Our own server at Hetzner | The payment. Bitcoin payments are public on the blockchain. |
Where a company is outside the European Economic Area, we rely on the safeguards the GDPR requires, such as the EU Standard Contractual Clauses.
6How long we keep data
- Account data and encrypted files: while your account exists.
- After you delete your account: we delete it from our live systems within 30 days. Database backups expire after 35 days. A storage that keeps only a copy deletes files 7 days after the main storage.
- Files you delete: when they leave the vault's trash, after 30 days or when you empty it, or at once in a vault with no trash. The same delays apply.
- Share links: the copy is deleted within ten minutes after the link ends. The download times go with it.
- Export links: the link, its list and its copies are deleted when it ends, after 7 days or sooner if you end it.
- Billing records: as long as tax law requires.
7Your rights
You can ask to see, correct, export or delete your personal data, to restrict or object to its use, and to withdraw consent where we rely on it. Write to [email protected] and we answer within 30 days. An export of your files from us gives encrypted data, which your apps can read and we cannot. To get your files decrypted, use Export files in the apps.
You can also complain to the data protection authority where you live.
8Requests from authorities
We answer only legally valid orders. We can hand over only what we hold: an email address, plan and payment records, sign-in records, and encrypted data that we cannot decrypt. We tell the person affected unless the law forbids it.
9Security
Encryption on your device is the main protection. On our side: TLS on every connection, keyed hashes for tokens and codes, encrypted backups, and server access limited to the people who run the service. If a breach affects your personal data, we tell you and the authority as the law requires.
10Children
Stonesafe is for people aged 18 and over. We do not knowingly keep accounts of children. If you believe a child has an account, write to us and we will delete it.
11Changes
We post every change here with its date. For a change that matters, we email you at least 14 days before it applies.
12Contact
[email protected] · [legal entity], [registered address]