Privacy Policy

Last updated: August 2, 2026

This Privacy Policy explains what information KyberCrypt collects, how we use it, and the choices you have. We designed the Service to collect as little as possible.

1. Information we collect

• Account data — your username and email address, and a password verifier (never your password itself; see Security below).
• Content you transmit — files and messages. These are stored encrypted; their contents and filenames are sealed inside the ciphertext.
• Operational metadata — timestamps, sizes, sender/recipient identifiers, and access/audit events needed to deliver and secure the Service.
• Payment data — handled by our payment processor; we do not store full card numbers.

2. How encryption limits what we can see

Content is sealed to the recipient's keys with hybrid post-quantum cryptography and stored as ciphertext. On the standard account path the server briefly processes content in memory while sealing or unsealing it to provide the feature you requested; it is never stored in readable form. For client-side ("maximum privacy") file requests and the native/CLI applications, encryption happens on your device and we receive only ciphertext we cannot read. See the Security page for the full custody model.

3. How we use information

To operate, secure, and support the Service; to send transactional email (verification, notifications, invitations); to process payments; to prevent abuse; and to comply with law. We do not sell your personal information, and we do not use it for advertising.

4. Sharing

We share information only with the service providers listed on our Subprocessors page, and where required by law (see our Law-Enforcement Guidelines). Each subprocessor is bound to appropriate confidentiality and data-protection obligations.

5. Retention

Content is deleted on download (burn-after-download) or when its retention period expires, per our Data Retention Policy. Account data is retained while your account is active and for a limited period afterward.

6. Your rights

Depending on your location (including under the GDPR and CCPA/CPRA), you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact privacy@kybercrypt.com. Note that because your encryption key is derived from your password, we may be unable to produce readable content we do not hold in readable form.

7. International transfers & security

The Service is hosted in the United States. We apply technical and organizational measures described on the Security page. No method of transmission or storage is 100% secure.

8. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

9. Changes & contact

We will post changes here with a revised date. Privacy questions: privacy@kybercrypt.com.