Privacy policy

The short version

• We collect what it takes to run rypt: your sign-in identity, what you create, an audit trail that includes IP addresses, usage counts, and billing records.
• The plaintext you send to be encrypted is processed and not stored. It passes through Cloudflare and Google Cloud on the way, and for Software and Hardware keys it goes to Google Cloud KMS.
• Google Analytics runs on rypt.dev and the dashboard.
• We keep audit rows, usage records, billing records, and the records of your keys and API keys indefinitely, including after your account is closed.
• We do not sell your personal information or use it for advertising.
• There is no self-service copy of your data or account closure yet. Email support@rypt.dev and we will send you a copy, or close your account and delete what Section 9 says we can.

This summary is not the whole policy. The sections below are.

Who we are and what this covers

x6c LLC, a West Virginia limited liability company ("x6c", "we", "us"), operates rypt. We decide how the personal information described here is used, and we are responsible for it. You can reach us at support@rypt.dev.

This policy covers the websites rypt.dev and sh.rypt.dev, the dashboard at dashboard.rypt.dev, the API at api.rypt.dev, and the command-line tools we distribute (together, the "Service"). It covers visitors, account holders, and anyone who emails us. For the Service, it replaces the privacy policy on x6c.co. The data you send to the API to be encrypted is covered separately, in Section 3. The terms of service govern your use of the Service.

What we collect, and where it comes from

When you visit rypt.dev

• Google Analytics. Every page on rypt.dev loads Google Analytics. It sets cookies, and records the pages you visit, the page that sent you here, your browser, device and screen size, your language, and an approximate location that Google works out from your IP address. It may also record how you use a page, such as scrolling, the links you follow and how long you stay. It collects this over time, across your visits. We do not send it your name, email address or account. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.
• The terminal demo. The terminal on the home page reads your browser's user agent, language, time zone and window size, and encrypts them in your browser with a throwaway key. It sends nothing anywhere.
• Hosting. Cloudflare serves the site. Like any web host, it receives your IP address, your user agent and the address you asked for. Cloudflare also asks your browser to report failures to load our pages to Cloudflare.

When you sign in

Dashboard sign-in is run by Auth0, a service of Okta, on an Auth0 tenant in the United States. You can sign in with Google or with an email address and password. Auth0 holds your sign-in profile: your email address, your name if you or Google provide one, your password in hashed form if you use one, and a log of your sign-ins with the IP address and browser of each. The sign-in page may run a bot check, which can involve a third-party bot-detection service. If you choose Google, Google tells Auth0 who you are, and Google learns that you signed in to rypt.

From Auth0 we receive a sign-in identifier, and your email address and name when Auth0 includes them. For a Google sign-in, the identifier contains your Google account number. We store the identifier, and the email address and name when we receive them. Your first sign-in creates your account, which is named after your email address, or after the identifier when we have no email address. The account's name is set once, and does not change when your email address does. We never receive your password.

When you use the dashboard

• What you create. The names you give your keys and API keys. Do not put personal information in them.
• Audit rows. When you create, rotate or delete a key, or create or revoke an API key, the audit log records your user id and the IP address you connected from.
• Google Analytics. The dashboard uses the same Google Analytics property as rypt.dev, so Google can connect your visits to both. The page addresses it receives can include the ids of your keys and the text you type into the key list's filter. We do not send it your name, email address or account.
• Hosting. Cloudflare serves the dashboard as it does rypt.dev, and receives the same details, including the address of each page you load, which can contain the ids of your keys.
• Your browser. The dashboard keeps your sign-in tokens in memory only, and saves your theme choice in your browser. Section 7 lists what it stores.

When you call the API

This includes the calls the dashboard and the command line make for you.

• Your API key. We store an Argon2id hash of each API key and its eight-character prefix, never the whole key.
• Audit rows. Each create, rotate and delete, and each encrypt, decrypt, wrap, unwrap and rewrap on one of your keys, writes a row with the time, the operation, the key and key version, the result and any error code, the request id, the IP address the request came from, the length of the input, and which API key or dashboard user acted.
• Usage counts. The number of operations on each key in each calendar month.
• Request logs. Each request is logged with its method, its URL (which contains the key id and any query), its HTTP version, request id, status and latency, and no headers or bodies. Google Cloud Run's own request log also records the user agent, which names the command-line version or browser you use, and the connecting address, which is a Cloudflare server.
• Usage log lines. Each cryptographic operation also logs a line with your account id, the operation, the result, the input length, and the request's method, URL and request id.
• Error logs. When something fails inside rypt, the error is logged with internal ids such as your account id and the key id.
• Request ids. If you send an x-request-id header, its value is kept in the logs and the audit row, so do not put personal information in it.

When you set up billing

Payments run on Stripe. When you first open checkout, we create a Stripe customer carrying your rypt account id, and your email address and name if we have them. You enter your payment method, billing address, email address, name and any tax id on Stripe's own pages, and they never pass through rypt. Stripe also collects information about the device you use on those pages, to detect fraud. Every few minutes we report each paid key's usage to Stripe: your Stripe customer id, a count, and an identifier that contains the key's id and the month. We keep your Stripe customer and subscription ids, your subscription's status and dates, and a record of the usage we reported. Stripe receives no plaintext and no key names.

When you use the command line

The installer downloads the rypt.sh script and its checksum from sh.rypt.dev, and nothing else. It saves your API key on your own computer, by default in ~/.config/rypt/api-key, readable only by your user. The script talks only to the rypt API. It sends your API key, the data you ask it to encrypt or decrypt, and a user agent that names its version. Neither collects usage statistics or checks for updates. sh.rypt.dev itself loads no scripts, sets no cookies and does not use Google Analytics. Cloudflare serves it, as it does rypt.dev.

When you email us

Mail to support@rypt.dev is received and stored on x6c's own mail server, which is backed up to storage we rent. We keep your message, your address and anything you include.

What you must give us

You need a sign-in to use the dashboard, and a payment method and billing address to use paid keys. Without them we cannot provide those parts of the Service. Nothing else we collect from you is required.

Data you send us to encrypt

The plaintext, ciphertext, data keys and additional authenticated data (aad) you send to the API are your content. We process them only to perform the operation you ask for. They are not stored in rypt's database, and the Service is built so that they are not written to its logs; only their length is recorded. We store no ciphertext: you keep what the API returns.

Your content passes through Cloudflare, which terminates TLS in front of rypt, and is processed on Google Cloud, where rypt runs. For Software and Hardware keys it is also sent to Google Cloud KMS, where the encryption runs. The Service is not zero-knowledge: it holds the keys that decrypt your ciphertext. The security page describes in more detail what rypt sees and keeps.

Your content will often include personal information about your own users. You decide what to send, and you are responsible for having the right to send it. For that content we are your service provider, on the commitments in Section 11 of the terms of service. We do not yet offer a separate data processing agreement; email us if you need one.

How we use it

• To run the Service: to sign you in, create your account, perform the operations you request, and show you your keys, usage and audit logs.
• To bill paid keys, work out tax, and keep accounting records.
• To keep the Service secure: to authenticate requests, enforce rate limits and monthly caps, investigate abuse and incidents, and keep an audit trail.
• To answer your email.
• To see how rypt.dev and the dashboard are used, and improve them.
• To comply with the law, and to enforce our terms.

We do not sell your personal information or use it for advertising, and we do not use it to make decisions about you that have legal or similarly significant effects. The Service does make the automatic decisions the terms describe, such as refusing a second free key, operations past a free key's monthly cap or over the rate limit, and new encryption on paid keys while billing is not in good standing. Auth0's bot detection can also stop a sign-in it judges automated.

Legal bases, if you are in the EEA, the UK or Switzerland

• Our contract with you, to provide your account, perform operations and bill you.
• Our legitimate interests, in keeping the Service secure, keeping an audit trail with the IP addresses that acted, preventing abuse, answering email, and understanding how our sites are used.
• Legal obligations, such as keeping tax and accounting records and responding to lawful requests.

Who else handles it

These providers handle personal information to run the Service. Most of them process it only for us. Google, when you sign in with it, and Stripe, for fraud prevention and its own legal duties, also use it for their own purposes, under their own privacy policies. You can read the providers' policies: Cloudflare, Google, Auth0 (Okta) and Stripe.

We also disclose personal information when the law requires it, to protect the rights, property or safety of rypt, our users or others, with your consent, or as part of a merger, acquisition or sale of assets, in which case this policy keeps applying to it. Because rypt holds the keys, a lawful order could require us to decrypt ciphertext that someone presents to us, or to disclose your account records and audit rows. Where the law allows, we will tell you about a legal demand that concerns you or your content before we comply with it.

Cookies and browser storage

api.rypt.dev and sh.rypt.dev set no cookies, and we use no advertising cookies. Google Analytics starts, and sets its cookies, as soon as a page on rypt.dev or the dashboard loads; we do not ask for consent first. To stop it, block its script from www.googletagmanager.com, for example with a content blocker, or install Google's opt-out add-on from tools.google.com/dlpage/gaoptout. Blocking only its cookies may not stop it from receiving the pages you view. You can block or delete cookies in your browser settings, though the dashboard needs Auth0's cookies to sign you in. Our sites do not change what they do in response to Do Not Track or Global Privacy Control signals.

How long we keep it

Your choices and rights

Wherever you live, you can ask us to do the following. Email support@rypt.dev from the email address you sign in with, and we will confirm by replying to it before we act.

• Access. We will tell you what personal information we hold about you and give you a copy. The dashboard already shows your profile, keys, API keys, usage and each key's audit log. It does not show the audit rows for creating and revoking API keys, which record your IP address; we include those when you ask for a copy.
• Portability. We will give you the information you gave us, and the records of your use, in a common machine-readable format such as JSON.
• Correction. Your email address and name come from your sign-in profile. Change them there, then ask us to update the copies we hold, including your account's name, which does not change on its own. Change your billing details in Stripe's billing portal, which the dashboard links to.
• Closing your account and deleting your information. There is no self-service closure yet. If you have a subscription, cancel it in Stripe's billing portal first; a paid key deleted when your account closes is still charged for that month, as the terms describe. On request we will revoke your API keys, delete your keys, delete the email address and name we hold, replace the sign-in identifier and the account name with random values, delete your Auth0 sign-in profile, and delete your customer record from our Stripe account once nothing is owed. Deleting a key destroys its key material, so decrypt anything you still need first. We keep what the law requires or allows us to keep: the audit log, which is append-only and records IP addresses and ids; the records of your keys and API keys, including their names; usage counts and usage log lines; billing records, and the records Stripe keeps of your payments; and your account's internal id, which the audit log refers to. Copies in database backups last until the backups expire.
• Objection and restriction. You can object to, or ask us to restrict, how we use your information. To stop Google Analytics, see Section 7.

We will answer within 30 days, or tell you why we need longer, up to the period the law allows. You can use an authorized agent where the law allows it, and we will not treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer with "Appeal" in the subject line. We will answer the appeal within 45 days and explain our decision, and if your state provides for it, you can then contact your state attorney general. If you are in the EEA, the UK or Switzerland, you can also complain to your data protection authority.

Security

API keys are stored as Argon2id hashes, each with its eight-character prefix in clear. The database has no public IP address and accepts only encrypted connections. Software and Hardware keys are held in Google Cloud KMS, and Free and Extra wrapped keys are stored in the database, wrapped under a root key held in Cloud KMS. Our sites and the API are served over HTTPS, so always use https:// addresses. The security page describes how keys are held and what the Service records.

No system is perfectly secure. If a security incident affects your personal information, we will notify you, by email to the address in your sign-in profile or billing details, and notify the authorities, as the law requires.

Where it is processed

x6c is in the United States, and rypt runs there, in Google Cloud and Auth0. If you use the Service from outside the United States, you send your information to us in the United States, whose data protection laws may differ from yours. Where the law requires a basis for that transfer, we rely on its being necessary to provide the Service you asked for. Our providers transfer data under the safeguards their own privacy policies describe. Cloudflare handles each request in its global network, usually at a data center near you, and Google Cloud Logging keeps logs in its global location.

Children

The Service is for developers and businesses, and you must be 18 or older to use it. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email us, and we will close the account and delete the information as Section 9 describes.

Changes to this policy

We will post any change on this page and update the effective date. If a change is material, we will post it at least 30 days before it takes effect, and we may also tell you by email. We will not use personal information we already hold in a way that is materially different from what this policy said when we collected it, unless you agree.

Contact

x6c LLC, at support@rypt.dev. Use the same address for privacy requests. To report a security issue, see the security page.