Privacy Policy

1. Who we are

The Secrets Vault is operated by FAHZY (Pty) Ltd, the responsible party for your personal information under the Protection of Personal Information Act (POPIA). Our service is available at www.thesecretsvault.com and is hosted on Amazon Web Services in South Africa.

Information Officer

Our Information Officer is the director of FAHZY (Pty) Ltd and is registered with the Information Regulator. For any privacy question or request, contact the Information Officer at privacy@thesecretsvault.com, or write to FAHZY (Pty) Ltd, 4 Naivasha Road, Sunninghill, Sandton, Gauteng, South Africa.

2. Information we collect

Account information

When you register, we collect:

• Email address
• First name and last name
• Phone number (optional; we don't use it for anything today)

Payment information

When you start a subscription or free trial, payment is handled by PayFast, our South African payment gateway. Card details are entered directly on PayFast's secure, PCI-DSS-compliant systems, so we never see or store your full card number. We store a payment token (a reference that lets us charge your saved card), your subscription status, plan, billing dates and payment history for accounting and to operate your subscription. If you add billing details (such as a company name, VAT number or billing address), we store them and print them on your invoices.

Security credentials

We store a one-way authentication hash derived from your master password. Your master password itself is never transmitted or stored. We also store a key derivation salt, an encrypted vault key and recovery credentials. None of these allow us to decrypt your vault. If you turn on two-factor authentication, we store your authenticator secret (encrypted in our database) or your security key's public key.

Encrypted vault data

We store the ciphertext of your vault, encrypted with AES-256-GCM in your browser before it is sent to our servers. We cannot decrypt it. We do not have access to your passwords, notes, usernames, or any other secrets you store.

Encrypted files

If you use the file storage feature, files and their names are encrypted in your browser before upload. We store only the encrypted bytes and the file size. We cannot access the contents or names of your files.

Family and team plans

If you run a family or team plan, we store the members' email addresses so we can send and manage invitations. The name you give your family is encrypted in our database. Organisation, collection and group names on team plans are encrypted in your browser, like vault items.

Activity log

We keep an activity log of vault actions (such as adding or deleting an item) so you can watch your account for unauthorised access. Each entry has the action and the time; the item's name is encrypted in your browser, so we can't read it.

Sign-in history and technical data

When you sign in we record the device and browser, your IP address and, where available, an approximate location worked out from it on our own servers, so we can show you your sign-in history and warn you about sign-ins from new devices. Our servers also receive standard request data, including your IP address and timestamps, which we use only for security, such as detecting abuse. None of this is used for marketing or profiling.

Website icons

To show a login's website icon, your browser asks our server for the icon of that website, sending only the website's name (for example www.example.co.za). It never sends the rest of the address, the username or anything else in the item. These requests carry no sign-in, so the website names aren't linked to your account, and we don't record them. Our server then fetches the icon from the website itself, so that website sees our server rather than you, and we keep the icon (not who asked for it) for up to a week. You can turn website icons off in Settings, under Vault list; your browser then sends nothing.

3. Zero-knowledge architecture

The Secrets Vault is built on a zero-knowledge principle. Your master password is used locally in your browser to derive an encryption key through PBKDF2 with 250,000 iterations. That key never leaves your device. All encryption and decryption happens entirely in your browser using the Web Crypto API.

This means that even if our servers were compromised, your vault contents would remain protected. It also means we cannot recover your vault contents if you lose your master password and recovery code.

4. How we use your information

We use the information we collect to:

• Create and manage your account
• Verify your email address and authenticate you securely
• Send transactional emails such as email verification, security alerts and notices about your data
• Display your name and profile within the application
• Enable two-factor authentication if you choose to set it up
• Process your subscription and payments through PayFast and manage your plan and storage
• Detect and prevent abuse, fraud and security threats, including repeated free trials
• Respond to support and privacy requests

We do not use your data for advertising. We do not build profiles for marketing purposes. We do not sell your data to any third party.

5. Transactional emails

We send emails necessary to operate the service, including email address verification, security notifications, billing emails and notices before we delete data (see section 8). These emails are sent through Amazon Simple Email Service (SES) in South Africa from no-reply@thesecretsvault.com. We do not send marketing or promotional emails.

6. Third-party services

We use the following service providers. Each processes data only as needed to provide the service:

• Amazon Web Services (AWS): cloud infrastructure, hosting, backups and email delivery. Your data is stored in South Africa. AWS is certified under ISO 27001 and SOC 2.
• PayFast (Payfast (Pty) Ltd): payment processing for subscriptions. You enter your card details directly on PayFast's PCI-DSS-compliant systems; they receive your name, email and card data to process payments and share the payment result and a reusable payment token with us. See PayFast's own privacy policy for how they handle your card data.
• Have I Been Pwned: when you run the breached-password check, your browser asks this service whether a password appears in known data breaches. See section 7 for exactly what is sent.

We do not use analytics or advertising services, and we do not share your personal information with any other third parties, except where the law requires it.

7. Data that leaves South Africa

Your account and vault data are stored in South Africa. A few things can still pass outside the country:

• Pages and requests from abroad. The site is delivered through Amazon CloudFront. If you use The Secrets Vault outside South Africa, your requests reach us through CloudFront locations near you, encrypted in transit. Nothing is stored there except copies of the public website.
• Emails we send you are delivered to your own email provider, which may keep them outside South Africa.
• The breached-password check. Your browser sends Have I Been Pwned the first five characters of a one-way (SHA-1) hash of each password it checks, never the password or the full hash. Have I Been Pwned is run from outside South Africa and sees your IP address. This only happens when you run the check.

We only use providers that protect personal information to a standard comparable to POPIA, as section 72 of POPIA requires.

8. How long we keep your data

• While you have an account, we keep your account and vault data.
• If you delete your account, your personal information, encrypted vault, files and activity log are deleted immediately. Deletion is irreversible. We keep a short record that the account existed and was deleted (name, email address, phone number and dates) for five years as part of our audit records.
• If you cancel your subscription, opt out during your free trial or are removed from a family plan, we keep your encrypted data for twelve months in case you come back. We email you 30 days before we delete it.
• If you sign up but never subscribe, we delete your account after twelve months without signing in. We email you 30 days before we do; signing in keeps it.
• Invoices and credit notes are kept for seven years for accounting and tax purposes, then deleted. They survive account deletion and keep the billing details they were issued with: your name, email address and, where you supplied them, your company name, VAT number and billing address. They never contain anything from your vault.
• Sign-in history and audit records are kept for five years.
• Our record of emails sent to you (the type of email and when) is kept for twelve months.
• Server logs are kept for 90 days, then deleted automatically.
• Backups. We take encrypted daily backups of our database. Daily backups are kept for 35 days and one backup a month for 13 months, so deleted data can remain in a backup until that backup expires. Backups are only used to restore the service.
• Free trials. To enforce one free trial per person, we keep a one-way cryptographic hash derived from the email address of accounts that have used a free trial. It cannot be reversed to recover your email, and it is kept after account deletion solely to prevent repeated free trials.

9. Your rights

Under POPIA (and, for European residents, the GDPR) you have the right to:

• Ask whether we hold personal information about you, and for a copy of it
• Ask us to correct or delete inaccurate or out-of-date information
• Delete your account and personal information
• Object to certain processing
• Take your data with you
• Complain to the Information Regulator

To exercise any of these rights, contact our Information Officer at privacy@thesecretsvault.com. We may need to confirm your identity first.

Because of the zero-knowledge design, we cannot provide the contents of your encrypted vault: we cannot decrypt it. You can export your vault yourself, decrypted in your browser, from within the application while your subscription is active.

If you're unhappy with how we've handled your personal information, you can complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za, inforegulator.org.za, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

10. Security

We protect your personal information with appropriate technical and organisational measures: TLS encryption on your connection to us and between our content delivery network and our servers; a database reachable only from our own server, on a private network; encrypted backups; access controls; and security monitoring. Your vault contents are protected by client-side encryption that we cannot bypass, and the few personal values our servers must be able to read, such as your two-factor authentication secret and your family's name, are additionally encrypted in our database.

Despite our efforts, no system is perfectly secure. If you discover a security vulnerability, please report it responsibly to privacy@thesecretsvault.com. If a breach ever affects your personal information, we will tell you and the Information Regulator as POPIA requires.

11. Cookies and local storage

The Secrets Vault does not use analytics, tracking or advertising cookies. We use browser session storage to hold your session token and decrypted vault key for the duration of your browser session. This data is cleared when you close the browser tab or log out. No persistent cookies are set for authentication purposes.

12. Children

Children are welcome to use The Secrets Vault, especially as part of a family plan. Under POPIA, anyone under 18 is a child, and we process a child's personal information only with the consent of a parent or guardian. On a family plan, the parent or guardian who invites the child gives that consent. A child who signs up on their own needs a parent's or guardian's permission first.

A parent or guardian can ask us at any time to see, correct or delete their child's personal information by contacting privacy@thesecretsvault.com.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of the page. For significant changes, we will notify you by email or by a notice within the application. Continued use of the service after any changes constitutes your acceptance of the updated policy.

14. Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, contact our Information Officer: