Privacy policy

Overview

Deeperguard is an encrypted notes service in public beta. We use a zero-knowledge protocol: your vault password and note content are never sent to our servers in readable form.

Zero-knowledge protocol

Deeperguard is built so the server stores ciphertext only and cannot decrypt your notes, even if compelled or compromised.

• Client-side encryption — Notes and attachments are encrypted in your browser or app before upload (AES-GCM).
• Vault password stays local — Your vault password is used only on your device to derive encryption keys. It is never transmitted to us.
• Zero-knowledge sign-in (SRP) — Account authentication uses the Secure Remote Password protocol. We store a verifier, not your password.
• Strict mode — When enabled (default on this deployment), the server rejects endpoints that would require your vault password.

We can still see account metadata (email, storage used, sync timing) and encrypted blobs. We cannot read note titles, body text, or attachment contents.

What we store

• Your email address and account metadata (sign-in method, 2FA status, storage used).
• Encrypted ciphertext for notes and attachments.
• Time warnings — if you set an email reminder on a note, we store only the note's random identifier and the chosen time so the reminder can be sent. The email contains a link and the time; never the title or contents.
• Operational logs (sync timing, reminder delivery status, errors) without note content.

What we do not store

• Your vault password (client-side only; zero-knowledge by design).
• Your account password in plaintext (SRP verifier only).
• Readable note content when strict zero-knowledge mode is enabled.

Third parties

Traffic is proxied through Cloudflare for HTTPS and abuse protection. Cloudflare sees connection metadata (IP, timing) but not decrypted note content.

Your responsibilities

Keep your password safe. Enable 2FA when available. Beta may have bugs — maintain your own backups of important data.

Contact

Questions: use the contact address shown on the registration page operator for this deployment.