This Privacy Policy explains how Fratera (“Fratera,” “we,” “us,” or “our”) handles information when you use Fratera websites, NullKey applications, and related services (together, the “Services”).
Zero-knowledge principle: readable vault contents are encrypted on your device. We store ciphertext needed to provide synchronization and storage, but we do not receive your Decryption Key and cannot decrypt your vault for you.
1. Information we process
Account information: your email address, authentication records, account identifier, confirmation state, and settings needed to create and secure your account.
Encrypted service data: encrypted vault records, encrypted folder names, encrypted notes, encrypted media, wrapped encryption keys, and synchronization metadata such as record identifiers and timestamps.
Device-local information: encrypted offline caches, preferences, quick-unlock material, AutoFill snapshots, and decoy-vault data may be stored locally using platform storage and security facilities.
Service and security data: limited technical records may be generated by infrastructure providers, such as IP address, request time, device or app version, authentication events, errors, and abuse-prevention signals.
Purchase information: where paid features are offered, Apple or payment/subscription providers may process purchases and provide us with transaction identifiers, entitlement status, and subscription status. We do not receive full payment-card details from Apple.
Communications: information you include when contacting support, including your email address and message.
Please do not send us your Decryption Key, Recovery Key, passwords, authenticator secrets, or unencrypted vault contents.
2. How we use information
We process information to operate and secure the Services; authenticate users; synchronize encrypted data; provide storage, recovery, support, AutoFill, and subscription features; prevent abuse; troubleshoot failures; comply with law; and improve reliability. Where applicable, our legal bases include performing our contract with you, legitimate interests in securing and improving the Services, your consent, and compliance with legal obligations.
Fratera websites and applications may use cookies, secure storage, or similar technologies that are necessary for sign-in, preferences, security, and core functionality.
3. When information is shared
We may use service providers for cloud authentication, databases, encrypted object storage, email delivery, app distribution, payment processing, and subscription management. These providers process information for their respective services and under their own terms and privacy notices. Current or anticipated providers may include Supabase, Apple, RevenueCat, and Paddle, depending on the platform and features you use.
We may also disclose information when required by law, to protect users or the Services, in connection with a corporate transaction, or with your direction. We do not sell readable vault contents, and we do not use vault contents for behavioral advertising.
4. Retention and deletion
We retain account and encrypted service data while your account is active and as needed to provide the Services. When you request account deletion, we will delete or de-identify information under our control unless retention is required for security, fraud prevention, dispute resolution, or legal compliance. Residual copies may remain temporarily in encrypted backups until they age out under provider schedules.
Some device-local information remains under your control and may require deleting the app, clearing local application data, or removing platform credentials. Exported files and copies you place in Photos, Files, backups, or other services are governed by those locations.
5. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of personal information; receive portable data; withdraw consent; or complain to a data-protection authority. Contact us to exercise a right. We may need to verify your identity before acting.
Because vault contents are encrypted and we do not possess your Decryption Key, we generally cannot inspect, recover, selectively correct, or provide readable copies of those contents. We can delete ciphertext associated with a verified account.
6. Security and international processing
We use technical and organizational safeguards appropriate to the nature of the Services, including client-side encryption, access controls, transport encryption, and restricted service credentials. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
Service providers may process information in countries other than yours. Where required, we rely on lawful transfer mechanisms and provider commitments intended to protect transferred personal information.
7. Children
The Services are not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from children who cannot lawfully consent. Contact us if you believe a child has provided information improperly.
8. Policy changes
We may update this Privacy Policy as the Services or legal requirements change. We will post the revised version with a new “last updated” date and provide additional notice when required.