Privacy Policy

Introduction

Recivity is an encrypted vault with a dead-man switch. You store critical information encrypted in your browser, check in on a schedule, and if you go silent, trusted beneficiaries can unlock access. This Privacy Policy describes what information we collect and how we use it.

Information we collect

Account information: name, email address, and a password hash if you register with email and password. If you sign in with Google, we receive your Google profile name, email, and profile image.

Vault information: encrypted document ciphertext, recovery question text, beneficiary names and email addresses, check-in timestamps, and escalation logs (reminder and release notifications).

We do not collect or store your vault passphrase, document plaintext, or recovery answer text. Those stay on your device or are derived only in the browser for encryption and decryption.

How we use information

We use account and vault metadata to authenticate you, operate check-in reminders and release notifications, and maintain vault state (active, warning, or released).

We do not sell your personal information.

Google OAuth

If you continue with Google, Google shares profile information with us according to your Google account settings and Google’s policies. See the Google Privacy Policy for how Google handles your data.

Third-party services

We use Vercel for hosting, Neon for Postgres database storage, and Resend for transactional email (check-in reminders and release notices). Those providers process data under their own privacy policies.

Data security

Vault documents are encrypted in the browser with AES-GCM before upload. A random document key is wrapped with a key derived from your passphrase (and separately from recovery answers). The server stores ciphertext and related crypto metadata; it cannot decrypt your vault contents.

No security practice is perfect. You are responsible for protecting your passphrase and account credentials.

Data retention

We keep your account and vault data while your account is active. If you want your data deleted, contact us at the address below. Self-serve account deletion is not available in the current version of the product.

Your rights

You may request access to or deletion of your account data by emailing us. We will respond within a reasonable time.

Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of Recivity after a change means you accept the updated policy.

Contact

Questions about this Privacy Policy: admin@recivity.com.

Disclaimer

This document is for informational purposes only and is not legal advice. It is an MVP draft and has not been reviewed by an attorney.