The privacy policy
fits on a page.

01

What we hold

Email, billing identity, device public keys, region preference, account.country_code (sourced from App Store storefront → Play regionCode → Cloudflare CF-IPCountry → user-declared; XX fallback; Tor → T1). For Drive, Mail, and ticket bodies we hold ciphertext encrypted at rest with HSM-wrapped server-held keys. Vault items stay on your device.

02

What stays end-to-end

Vault items are encrypted with a key derived on-device from your master password — we receive ciphertext only and cannot decrypt them. This is the one surface where the zero-knowledge claim holds (ADR-0068).

03

Server-trust posture

For Drive, Mail, ticket bodies, and any other content we hold for you, an admin read is technically possible. We gate every read on a dual-key ceremony and a PII redactor, and we record every access in the immutable audit log. We are a server-trust SaaS, not zero-knowledge (ADR-0069).

04

How long we keep it

Connection counters per region: 14 days. Billing records: 7 years (statutory). Crash logs: 30 days, scrubbed. Lawful-intercept records: 30 days from the closure of the order, then destroyed.

05

Where it lives

US bare metal, primary in San Jose and Ashburn. EU mirrors in Frankfurt and Amsterdam for EU residents. RAM-only tunnel servers. Backups encrypted, off-prem.

06

Subpoenas

Disclosed in our live transparency counter. Total served / produced / under seal: 0 / 0 / 0 as of 2026-04-28.

07

Your rights

Article 15 signed export (everything we hold for you). Article 17 erasure cascade (delete pulls every plugin's state of you). Portability, complaint to your DPA. Self-serve from Settings → Account.

08

Country availability

Some features may be unavailable in your country per local regulation. Foundational surfaces (auth / billing / support / audit) are always on; pluginable features (VPN / eSIM / Drive / Mail / Vault / Identity / Agents) follow the per-country availability matrix in your app.

09

Lawful-intercept capability

Bayria, Inc. (San Francisco, CA) can be compelled by a US court of competent jurisdiction — or, for EU users, via MLAT — to enable per-account logging on a named user. For the named account only and for the duration of the order we may capture: VPN destination IPs, DNS queries, request and response headers, request bodies, and Drive / Mail object plaintext (decrypted server-side from our HSM-wrapped keys per ADR-0069). Vault items remain end-to-end encrypted and outside this capability. Every read is dual-key-gated, PII-redacted, and recorded in the immutable audit log; counts are published in the transparency counter.