Privacy policy

Data controller

The data controller for personal data processed through Deeperguard is:

• Name: Schutten Invest
• Address: Schutten Invest, Lisdodde 66, 2408 LX Alphen aan den Rijn, Netherlands
• Chamber of Commerce (KvK): KvK 99268876
• Contact email: [email protected]

Questions about this policy: see also Contact.

Overview

Deeperguard is an encrypted notes service in public beta. We use a zero-knowledge protocol: your vault password and note content are never sent to our servers in readable form, except text you choose to send to Ask AI with Ollama Cloud. We can still see account metadata and encrypted blobs; we cannot read note titles, body text, or attachment contents (unless you send text to Ask AI with Ollama Cloud).

Zero-knowledge protocol

• Client-side encryption — Notes and attachments are encrypted in your browser or app before upload (AES-256-GCM, with keys derived from your password using Argon2id).
• Vault password stays local — Your vault password is used only on your device to derive encryption keys. It is never transmitted to us.
• Zero-knowledge sign-in (SRP) — Account authentication uses the Secure Remote Password protocol. We store a verifier, not your password.
• Strict mode — When enabled (default on this deployment), the server rejects endpoints that would require your vault password.

What is processed and legal basis

We process the following categories of data. Where GDPR applies, the legal basis is Article 6 as noted.

• Account email — to create and administer your account, send verification and service messages (Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests for security notices).
• SRP verifier — a cryptographic proof that lets you sign in without sending your password. We do not store your account password in plaintext (Art. 6(1)(b)).
• Encrypted vault data — ciphertext for notes, attachments, and related sync items. The operator cannot read this content (Art. 6(1)(b)).
• Account metadata — sign-in method, 2FA status, storage used, plan, session device labels, sync timing (Art. 6(1)(b) and 6(1)(f)).
• Time warnings — if you set an email reminder on a note, we store the note’s random identifier and the chosen time so the reminder can be sent. The email contains a link and the time; never the title or contents (Art. 6(1)(b)).
• Server IP and request logs — connection metadata used for security, abuse prevention, and debugging (Art. 6(1)(f)).
• Cloudflare / Turnstile — HTTPS proxying and bot checks. Completing Turnstile on sign-up sends a short-lived token to Cloudflare for verification; it does not include your vault password or note content (Art. 6(1)(f)).
• Secure Send ciphertext — when you use Secure Send, we store an opaque encrypted blob and length. The link stops working when it expires (max 7 days), when its allowed views are used, or when you cancel it. We do not store the decryption key (which stays in the URL fragment on the devices that share the link) (Art. 6(1)(b)).

What we do not store

• Your vault password (client-side only).
• Your account password in plaintext (SRP verifier only).
• Readable note content when strict zero-knowledge mode is enabled.
• Secure Send decryption keys or optional passphrases (client-side / fragment only).

Retention

• Account and vault ciphertext — kept while your account exists, then removed when the account is deleted. Backup copies you export yourself are under your control. We keep up to 14 encrypted server backups.
• Signed-in sessions — default cookie lifetime is 30 days, unless configured otherwise on the deployment.
• SRP login challenges — short-lived server challenges expire after 300 seconds and are pruned.
• Application logs — sync and device-report logs on the origin are rotated by size (5 MB) with up to 5 rotated copies compressed. Broader edge access logs (for example Cloudflare) follow that provider’s retention; this service does not keep a separate edge access-log archive.
• Secure Send — the link stops working when it expires (max 7 days), when its allowed views are used, or when the sender cancels it.
• Email verification / backup codes — hashed codes with an expiry timestamp; cleared after use or expiry. Exact code lifetime: 30 minutes.

Processors and server location

• Cloudflare — reverse proxy, DDoS/abuse protection, and Turnstile. Processes connection metadata and bot-check tokens.
• Hosting — netcup GmbH, with the server located in Austria (EU).
• Email (Proton Mail) — transactional mail such as verification and service messages, and encrypted account backups sent by email when that backup path is enabled.
• pCloud — optional encrypted backups when you connect pCloud in Settings; only ciphertext is uploaded to your pCloud account.
• AI relay (Ollama Cloud) — if you use Ask AI with Ollama Cloud, the text you send (which may include note content) passes through the Deeperguard server unencrypted and is forwarded to ollama.com using your own API key. The relay does not store or log the key, the prompt, or the answer. Ollama processes it under its own terms.
• Optional backups you choose — encrypted backups you save or share (for example Files / iCloud Drive, Google Drive, or Dropbox) are created on your device. Those providers process only the encrypted blob under their terms; we do not receive your vault password or plaintext notes for those destinations.
• International transfers — Cloudflare may process connection data outside the EU under Standard Contractual Clauses.

Your rights

If GDPR applies to you, you may have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure (“right to be forgotten”), subject to legal exceptions
• Data portability for data you provided, where applicable
• Object to processing based on legitimate interests
• Lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)

To exercise these rights, email [email protected] (or use Contact). Because of zero-knowledge design, we cannot decrypt your notes to fulfil a content-access request — we can act on account metadata and account deletion.

Your responsibilities

Keep your password and recovery material safe. Enable 2FA when available. Beta may have bugs — maintain your own backups of important data.

Contact

Privacy questions: [email protected]. General contact: Contact.

Last updated: 24 October 2026