Privacy policy

1. Who we are

Gonbi Digital Vault ("Vault") is operated by Gonbi Digital, based in Australia. Vault runs on infrastructure we manage ourselves rather than a third-party secret-sharing platform. For anything in this policy, contact us at vault@gonbidigital.com.au.

We handle personal information in line with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

2. What we never see

Two things never reach our database in a readable form:

• The access code. It is used in your browser session only to derive an encryption key. It is never written to disk, never logged, and cannot be recovered or reset by us.
• The plaintext of your secret. We only ever store the encrypted result. Without the access code, the stored data is not decryptable - by us, by an attacker with database access, or by anyone else.

A practical consequence: if you lose the access code, the secret is unrecoverable. That is by design, and we cannot make an exception.

3. What we do store

Secrets you create

• The encrypted payload (AES-256-GCM; the key is derived from your access code using PBKDF2-SHA256 with at least 100,000 iterations and a random salt).
• A random 48-character share token, which forms part of the link you send.
• Your optional label, tags, and folder - these are stored unencrypted so you can find the secret in your dashboard, so please do not put sensitive detail in them.
• Settings and state: expiry time, maximum allowed attempts, attempts used, whether the link is reusable, and when it was viewed.
• Your user ID, if you were signed in when you created it. Secrets created by guests are not linked to any account.

Account information (only if you register)

• Your name and email address.
• A hashed password - we never store the password itself.
• If you enable two-factor authentication, an encrypted TOTP secret and recovery codes.
• Your plan, and the tags and folders you create.

You can use Vault to send a secret without creating an account at all.

Audit log

To let owners see what happened to their secrets and to detect abuse, we append a record for these events: creation, successful reveal, failed attempt, lock-out, manual burn, regeneration, and expiry. Each record holds:

• The event type, the share token, and a timestamp.
• A SHA-256 hash of the IP address - not the address itself.
• The browser user-agent string, truncated to 512 characters.
• Small technical metadata, such as attempt counts. Never the secret, the label content, or the access code.

Cookies and session data

We use a session cookie, a CSRF-protection token, an optional "remember me" cookie if you ask to stay signed in, and a cookie storing your light/dark appearance preference. These are strictly functional - we do not set advertising or cross-site tracking cookies.

Rate limiting

To block brute-force attempts on links, we count requests per IP address in a short-lived cache. These counters expire on their own within minutes and are not part of any long-term record.

4. Analytics and error tracking

Product analytics are handled by PostHog. We send a small server-side event when a secret is created or a reveal page is opened, containing: the event name, the request IP address, the page URL, a session identifier, and your user ID if you are signed in. We also send exception details when the application errors, so we can fix faults.

Analytics events never include the secret text, the access code, the label, or the share token's decrypted content. We do not run third-party advertising or marketing trackers in the browser.

5. How long we keep things

• Revealed secrets: the encrypted payload is wiped from the record immediately on a successful reveal. The record itself is deleted by a scheduled purge that runs every hour.
• Expired secrets: unopened secrets stop working at their expiry time and are deleted by the same hourly purge.
• Locked secrets: when the maximum number of failed attempts is reached, the link stops working and the payload is destroyed.
• Burned secrets: deleted immediately when you burn them from your dashboard.
• Audit log entries: kept for 30 days and then deleted automatically by the hourly purge. They outlive the secret itself so that security investigations remain possible during that window, and they contain no plaintext and only a hashed IP address. Contact us if you want entries relating to your account removed sooner.
• Accounts: kept until you delete them. Deleting your account from your settings page removes your profile and your remaining secrets.

6. Who we share data with

We do not sell your data, and we do not share it for advertising. Data is disclosed only to:

• Our hosting and infrastructure providers, to the extent needed to run the service.
• Our email provider, for transactional messages such as email verification and password resets. We do not send marketing email.
• PostHog, for the product analytics described in section 4.
• Law enforcement or regulators where we are legally required to do so - noting that we cannot produce the plaintext of any secret, because we do not have it.

7. How we protect your data

• AES-256-GCM authenticated encryption, with keys derived per secret via PBKDF2-SHA256.
• Constant-work decryption on incorrect access codes, to limit timing side-channels.
• Attempt limits and per-IP rate limiting on link reveals, secret creation, and dashboard actions.
• HTTPS in transit, a Content Security Policy, and hardened security response headers.
• Optional two-factor authentication on accounts.

No system is completely secure. Sharing the access code through a channel different from the link is the single most effective thing you can do to keep a secret safe.

8. Your rights

You can ask us to:

• Confirm what personal information we hold about you, and give you a copy.
• Correct anything inaccurate - your name and email are also editable in your settings.
• Delete your account and associated data. Account deletion is self-service in your settings.

Email vault@gonbidigital.com.au and we will respond within 30 days. If you are unhappy with how we handle a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Children

Vault is intended for business and technical use and is not directed at children. We do not knowingly collect personal information from anyone under 16.

10. Changes to this policy

If we change how we handle personal information, we will update this page and revise the date at the top. Material changes affecting account holders will also be sent by email.

11. Contact

Gonbi Digital
vault@gonbidigital.com.au
gonbidigital.com.au