Privacy policy

Who is responsible?

Red Impact LLC, 30 N GOULD ST STE R, SHERIDAN, WY 82801, United States, is responsible for personal data used to operate accounts and the service. Privacy contact: privacy@egarots.app. You determine the contents of the files you upload and who you share them with.

Information we process

Account and security: verified email address, profile name, account and vault identifiers, preferences, access permissions, hashed session tokens, expiration and revocation timestamps, public passkey credentials, and temporary sign-in or device-pairing requests. Egarots verifies email codes using a cryptographic digest; the email provider necessarily processes the code to deliver the message.

Storage: encrypted objects, technical identifiers and folder relationships, sizes, types, versions, timestamps, upload and deletion status, and sharing or agent permissions. Encryption does not conceal all of this metadata. Operations: IP addresses and technical information needed for delivery, security and troubleshooting. Support: information you choose to send us.

Encryption and keys

File names and contents are encrypted on your devices before upload. Ordinary storage does not send your plaintext master key to Egarots. Losing the recovery file and every authorized device can make your files unrecoverable.

A complete sharing link contains a key, or a password-protected key, after the # character. Browsers do not normally include that fragment in an HTTP request. Someone who has the complete link and, where required, its password can decrypt the shared items.

An exception you choose: a hosted agent that works while your device is off requires you to delegate a key to the server. This key is stored encrypted and lets the server decrypt data for authorized agent actions. Scope, expiration and revocation restrict future access; they cannot remove a copy already downloaded.

Purposes and legal bases

Providing your account, authenticating devices, storing and sharing files, and handling service requests: performance of the service you request. Preventing abuse, protecting infrastructure and investigating incidents: our legitimate interest in securing the service using proportionate measures. Complying with legal requirements: legal obligation. Where optional processing requires consent, we request it separately and you may withdraw it for the future.

Providers and recipients

Cloudflare processes information needed for hosting, storage, security and email. Messages sent to Egarots professional email addresses are forwarded to the team’s Gmail and iCloud inboxes, provided by Google and Apple, so we can respond. Access should be restricted to authorized team members.

People and agents you authorize receive access according to the permissions you grant. We may disclose information in response to a valid legal requirement. Egarots does not sell account data or include targeted advertising in this version.

International processing

Red Impact LLC is based in the United States and Cloudflare operates global infrastructure. Data may be processed in different countries, including the United States; Egarots does not promise exclusively European hosting. Where applicable rules require safeguards for international transfers, those transfers must be covered by recognized safeguards. Contact privacy@egarots.app for information relevant to your situation.

Retention and deletion

Account information and files are retained to provide the service while you maintain your space. Moving a file to Trash does not permanently delete it: versions, Trash and share references may retain objects. Use the relevant permanent-deletion and revocation controls.

Email codes expire after 10 minutes. Web sessions last up to 7 days and mobile sessions up to 30 days unless revoked earlier. These deadlines prevent further access; they do not promise immediate erasure of technical records. Pairing requests and rate-limit records also stop authorizing actions when they expire.

You can request account deletion at privacy@egarots.app. We verify and handle the request, subject to information needed for legal obligations or disputes. Support correspondence is retained for handling and necessary follow-up. You may ask which records remain and why.

Cookies and information on your device

Session and security cookies, together with local storage, support sign-in, preferences, transfers and offline features. The web application keeps an unlocked key in memory and removes it when the vault is locked. Mobile and desktop clients use their platform’s storage mechanisms. Our Cookies and local storage page explains these uses. Egarots does not add advertising trackers or third-party audience analytics in this version.

Your rights

Depending on applicable law, you may request access, correction, deletion, portability or restriction, object to processing, or withdraw consent. Email privacy@egarots.app with enough information to identify the relevant account, without disclosing your encryption key. We may need proportionate identity verification and respond within applicable legal deadlines.

You may complain to the relevant data protection authority, including the CNIL in France (cnil.fr). Egarots is intended for people with the legal capacity and permissions needed to use it. The date above identifies this policy’s latest update; material changes are communicated by appropriate means.