Designed ARDNTECH zero-knowledge: we cannot read your secrets, even if we wanted to.
My personal data area
Direct access to each chapter of the policy. The full text is readable below; the links anchor directly to the section that interests you.
Controller
Architecture
Data
ARDNTECH encrypts your secrets in your browser before any transit. We technically have no access to their cleartext content. This privacy policy describes the data we actually process (email, password hash, technical metadata) and the associated legal bases.
Three educational boxes to qualify the technical boundary of privacy ARDNTECH. This visibility map is technically enforceable: it follows directly from the cryptographic architecture, not from a contractual commitment.
No judicial requisition can compel us to hand over these elements: we do not hold them.
A full dump of our database reveals no secret in cleartext: the blobs are AES-256-GCM SEIPDv2 per RFC 9580.
Strictly necessary to the organisation of the service. Retained in accordance with the durations detailed in section 7.
The legal entity responsible for the processing of your personal data and the point of contact for its data protection officer.
The data controller is the Publisher (ARDNTECH), whose details appear on the Legal notice.
Data Protection Officer (DPO): dpo@aegirex.eu.
ARDNTECH encrypts your secrets in your browser before any sending. Our servers store only opaque OpenPGP blobs, encrypted for your public key only.
As a result, we have no technical access:
You can verify these claims by consulting the public source code in our GitHub repository. The security architecture page details the cryptographic stack RFC by RFC.
To run the Service, we process the following categories of data, grouped by purpose.
If enabled, we compute a partial hash of your email address (k-anonymity) to check whether it appears in a public breach. HIBP never receives your email in cleartext. Can be disabled from your privacy settings (GDPR Art. 21).
Although the content of the secrets is encrypted and inaccessible to the Publisher, certain technical metadata are necessary for organisation and remain visible server-side:
The content (password, API key value, etc.) is encrypted and inaccessible to the Publisher.
For each processing activity, the corresponding GDPR Article 6 legal basis. No data is processed without an explicit basis.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the encrypted storage service | Performance of the contract (Terms) |
| Authentication and security (rate limiting, audit chain) | Legitimate interest + security obligation (GDPR Art. 32) |
| Transactional communications (signup, sharing, alerts) | Performance of the contract |
| HIBP scan (opt-in) | Explicit consent |
| Retention of audit logs | Legitimate interest + legal obligation (traceability) |
Your data is communicated only to the technical subprocessors strictly necessary to the operation of the Service.
No resale, no profiling. No data is resold, exchanged or transmitted for marketing or advertising profiling purposes.
ARDNTECH favours French or European subprocessors. A single outbound flow outside the EU exists, and it is cryptographically protected.
The only outbound flow outside the EU is the HIBP scan (Australia), which uses a cryptographic mechanism (k-anonymity) guaranteeing that no identifiable personal data leaves the EU. The technical detail is available in the public security documentation.
The HIBP scan can be disabled individually (user settings) and globally on the administrator side of a self-hosted instance.
Each category of data is retained for the minimum duration necessary to its purpose, in accordance with the GDPR Art. 5 minimisation principle.
| Category | Duration |
|---|---|
| Active account | The entire duration of use of the Service |
| Inactive account (no login for 24 months) | Notification + deletion after 30 days |
| Account deleted on request | Immediate deletion of identifying data |
| Audit log (one-way hash) | 3 years (traceability obligation) |
| Connection IP address | 30 days |
| Application server logs | 30 days |
The rights granted by the GDPR are exercisable directly with our DPO. Several are also tooled in self-service from your account settings.
Seven categories of technical and organisational measures implemented to protect your data in accordance with Article 32 GDPR.
Audit and verification. The detail of the cryptographic stack RFC by RFC, the formalised threat model and the audit chain verification procedure are published on the security architecture page.
ARDNTECH uses only cookies strictly necessary to the operation of the Service. No third-party cookie, no tracking pixel, no analytics tool.
No consent required. No third-party cookie, no tracking pixel, no analytics tool is set. Prior consent is therefore not required within the meaning of the CNIL (Deliberation 2020-091).
The conditions and time frames within which this policy may evolve, and the commitments to notify users.
The Publisher may amend this policy at any time. Users are informed by email of substantial changes with a notice period of fifteen (15) days.
The current version is always dated at the top of the page. The change history is archived and available on request to the DPO.
Contact details of the Data Protection Officer for any question relating to your personal data or the exercise of your rights.
Postal address
See Legal notice.
Response time
One month maximum, in accordance with Article 12 GDPR.
For businesses
Data processing agreement (DPA) available.
ARDNTECH was designed so that privacy does not depend on the publisher's good faith. If a question remains about a processing activity, a retention period or a right, contact our Data Protection Officer directly. For businesses, a standardised data processing agreement is available.
