Privacy Policy

1. The short version

Your account is anonymous — an account number and a password, with no email address or name attached. Your vault is encrypted on your device before it is sent anywhere. We hold encrypted blobs we cannot open, plus the small amount of account information needed to run the Service.

2. What we collect

• •Account information: a randomly generated account number, a one-way hash of your password, and an optional username you choose. We do not collect your real name, email address, or profile image.
• •Subscription information: your plan, subscription status, and a customer identifier from our payment provider, Polar. Card details are handled by Polar and never reach our servers.
• •Encrypted vault data: if you enable cloud sync, we store the encrypted vault file and encrypted file attachments, along with metadata such as file name, size, and timestamps.
• •Technical data: IP address, browser or app version, and device information contained in ordinary server logs and session records.
• •Diagnostics and usage: crash reports and aggregate product analytics that tell us which features are used and where errors occur.

3. What we cannot see

We never receive, and cannot recover:

• •Your account password — we store only a one-way hash of it.
• •Your master password, PIN, or 24-word recovery phrase.
• •The contents of your vault — passwords, notes, cards, and files are encrypted with keys only you hold.
• •The contents of files you upload through cloud sync.

4. How we use your information

We do not sell your personal information, and we do not use your data to build advertising profiles.

• •To create and operate your account and sync your encrypted vault between your devices.
• •To process subscriptions, enforce plan limits, and prevent abuse.
• •To provide support when you contact us.
• •To fix bugs, monitor security, and improve the product.
• •To send essential service messages through our payment provider, such as billing notices.

5. Who we share it with

We share only what is needed with service providers who help us run Guard, and they are bound to protect it:

• •Polar — payments, subscriptions, and invoicing. If you subscribe, Polar collects an email address from you for billing and receipts; that address stays with Polar and is never sent to us.
• •Our hosting, storage, and content-delivery providers — running the website and holding encrypted vault and file data.
• •Error-monitoring and analytics providers — diagnostics and aggregate usage data.

6. Legal disclosure

We may disclose information if we are legally required to. Because your vault is encrypted with keys we do not hold, the most we can ever produce is account information and encrypted data that we cannot decrypt.

7. Data retention and deletion

We keep your account information for as long as your account exists. Encrypted vault versions and uploaded files are retained until you delete them or delete your account.

You can delete uploaded files from your account dashboard at any time. To delete your account entirely, email help@guardpin.com — we remove your account information and encrypted data, other than records we must keep for legal or accounting reasons (such as invoices).

8. Security

Vault data is encrypted with AES-256 on your device before upload. Keys are protected by your PIN using Argon2id and by a device key held in your operating system's keychain. Traffic between your devices and our servers is encrypted in transit.

No system is perfect. If we ever become aware of a breach affecting your data, we will notify affected users promptly.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. Guard holds almost none: your account has no name or email attached to it. You can edit your username from your dashboard, and you can exercise any of these rights by emailing help@guardpin.com. We respond within the time required by applicable law.

California residents: we do not sell or share personal information as those terms are defined by the CCPA, and you will never be discriminated against for exercising your privacy rights.

10. Cookies

We use a small number of essential cookies to keep you signed in and to secure your session. We do not use advertising cookies.

11. Children

Guard is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will remove it.

12. International transfers

Guard is operated from the United States, and your information is processed there and in the regions where our providers operate. Where required, we rely on appropriate safeguards for international transfers.

13. Changes to this policy

We may update this policy. Material changes will be announced on this page with a new date at the top, and where required we will ask you to review the change before continuing.

14. Contact

Privacy questions: help@guardpin.com. Security reports: security@guardpin.com.