Your privacy at DigiSafe

• Your documents, their names and details, and the answers you give when you sign up are encrypted on your device before they are uploaded. We can’t read them.
• We can read a small amount: your name, email address, sign-in and consent records, and the dates and sizes needed to keep your devices in sync.
• Your encrypted data is stored with Supabase in Tokyo, Japan.
• No adverts, no analytics, no trackers. We don’t sell your information.
• You can download everything, or delete your account, from Account at any time.
• DigiSafe is an independent, private app. It is not a government service and is not affiliated with DigiLocker, UIDAI or any government body.

DigiSafe is made and run by Kavion Solutions (“we”, “us”). This policy explains what information the DigiSafe app and website handle, why, and the choices you have. It applies wherever you use DigiSafe: on a phone, a tablet or a computer.

To ask about anything here, email kavionsolutions13@gmail.com.

DigiSafe is built so that your private information is locked before it leaves your device. It is encrypted in your browser with AES-256-GCM, using a key that only exists on devices you have unlocked. What reaches our servers is scrambled data we have no way to open. This covers:

• Your documents: every scanned page, thumbnail and PDF.
• Folder details: names, descriptions, icons and colours. Folder identifiers are also blinded (turned into a code using a key from your vault), so we can’t tell a passport folder from any other.
• Document details: names, notes, file types, what kind of document each one is, its expiry date, the words read from it so you can search for it (never its numbers), and bill and warranty details (apart from what you choose to share for a payment reminder, below).
• Your profile: the countries you picked, your mobile number, state or province, the kinds of documents you care about, whose documents you keep, whether you want reminders, and your note that you understand how recovery works.
• Family folders: folder names and everything inside them, locked with a key only the folder’s members hold.
• Your emergency card: if you make one, everything on it (blood group, allergies, conditions, medicines, contacts and your note). It is locked on your device with a key that is only in the card’s QR code and link, never sent to us. Your own copy, with that key, is locked with your vault key. Anyone you give the QR code or link to can read the card; we can’t.

Your password and PIN

Your password is not sent to us. Your device turns it into a sign-in token, and we store only a one-way hash of that token. We also keep a copy of your vault key that is locked with your password, so you can open your vault on a new device. Without your password that copy is useless.

Your PIN is never sent to us either. So that one PIN works on all your devices, we store a sealed check of it that can only be opened with your unlocked vault key. If you turn on fingerprint or face unlock, that stays on your device: we never receive fingerprint or face data.

Numbers such as a PAN or passport number are read from your pages on your own device. Pages are not sent anywhere to be read.

To run your account and keep it safe, we store some information we can read:

• Account: your name, your email address, whether and when you confirmed it, and when your account was created and last changed. We use your name to greet you in emails.
• Sign-in and sessions: a hash of your sign-in token, a hash of each session token with its start and end dates, when you last used DigiSafe (to the nearest ten minutes), and counts of failed sign-ins and temporary lockouts. Failed sign-ins are counted against a hash of the email address, not the address itself.
• Consent records: which version of the Terms and this policy you agreed to and when, when you confirmed you are 18 or older, and whether (and when) you chose to get product emails.
• Sync information: the blinded folder codes, random document identifiers, when each item was last changed or deleted, when your profile and PIN were last changed, and the size of each encrypted file in storage. Because each page is stored as its own file, this also shows how many pages a document has. Deleted items leave a small marker so your other devices remove their copies too.
• Sign-up codes and email links: while you sign up, your name, email and a hash of your sign-in token and the emailed code, for up to 10 minutes. Password reset and email confirmation links are stored as hashes with an expiry time.
• Abuse protection: to slow down attacks, we count requests for a short time. The count is linked to a one-way hash of your IP address, your email address or your account, depending on the action, never the address in readable form.
• Share links: if you share a document by link, we keep the file type, size, expiry time, how many times it may be opened and has been opened, wrong code attempts, and a hash of the optional code. The document copy is encrypted with a key that sits in the link itself and is never sent to us. We record the time each of your share links is opened, and nothing about who opened it.
• Family folders: if you use them, we can see who is in which family folder, each person’s role, whether an invitation was accepted, and when things change. We store each member’s public keys so others can share folders with them. Members of a folder can see each other’s names and email addresses.
• Invite links: if you ask for your invite link, we keep the short random code in it. If you join through a friend’s invite link, we note who invited you, so they can see how many friends joined and how many started using DigiSafe. They never see who you are.
• Referral points: a history of the points you earned, used or lost (how many, why and when, and when they expire), kept with your account. To make sure each email address is rewarded only once, we also keep a one-way fingerprint of the email of each person who joined through an invite link, and of every account that is deleted, not the email itself. It is made with a secret key, so it can't be turned back into an email address. It stays after the account is deleted, and is used for nothing else. We only look at whether your first document, reminder or bill exists, never what it contains.
• Payment reminders: if you set one up, the name you gave the bill, the date it is due, your client’s name and email address if you add them, and when reminders were sent. We use these only to send the reminders you asked for. The bill itself, and the link that opens it, never reach us: you send those to your client from your own phone, and our reminder emails contain no link to the bill.
• Notifications: if you turn them on, the address your browser gives us for sending notifications to that device, your notification settings (which kinds you want, the time reminders arrive, quiet hours and your time zone), and when each reminder is due. The text of reminders about your documents is locked on your device before it reaches us, so we can’t read it. Messages we write ourselves, such as a new sign-in alert or news from DigiSafe, we can read. Turning notifications off on a device, or signing out there, removes that device. A copy of each notification is kept for the bell in the app (reminders still locked) and clears itself after a while: two days for reminders, seven for sign-in and payment alerts, and as long as we chose for news. You can delete them yourself at any time.
• Your reminders: the reminders you set (medicine, payments, subscriptions and others) are encrypted on your device, names, doses, amounts and notes included, so we can’t read them. To send each notification on time we do see when it repeats (for example “8:00 every day” or “the 10th of every month”) and your time zone. Deleting a reminder stops and removes its schedule.
• Emergency card: if you make one, that it exists, the random code in its link, and when it was last changed. When someone opens the card, our servers see the request like any other (see below). We don’t record which card was opened; to stop abuse, the network address of whoever opens one is kept for about a minute.
• Nominee access: if you choose a nominee, who you named and who named you, the periods you chose, the dates of reminders, alerts and release, and short labels for each change (for example “alert started”), never what is inside. The documents you choose are copied and locked on your device with a key we never have; only your nominee can open them, and only after release. Until your nominee joins DigiSafe, we keep only a one-way, keyed fingerprint of their email address (not the address itself) so we can match them when they sign up. We send them emails about the invitation and any access request, which include your name.
• Decoy PIN: works only on the device where you set it up. Nothing about it, including whether you have one, is ever sent to us.
• Support requests: if you contact us through the app, your name, email address, what you wrote, our replies, and the kind of device and browser you were using, so we can help. Please don’t include document numbers or passwords.

Like any website, the servers that deliver DigiSafe also receive technical details with each request, such as your IP address and browser type. Our hosting providers may keep these in short-term logs for security and to fix problems.

DigiSafe works offline, so it keeps a copy of your vault in your browser’s storage on each device you use:

• Your document pages, stored encrypted.
• A locked copy of your vault key and, if you turned it on, the fingerprint unlock copy.
• Your folder and document details (such as names, notes, expiry dates and the words read for search), your sealed profile, and your settings such as theme, font and auto-lock time.

Folder and document details are kept readable in the browser so the app can open quickly and offline. Protect your device with a screen lock, and before you give a device away, clear DigiSafe’s data on it (in your browser’s site settings, or by removing the installed app).

In supported browsers, DigiSafe also saves its own program files (pages, scripts and the on-device number reader) so it can start offline. Your documents and the answers from our servers are never saved in that cache.

We use one sign-in cookie, named __Host-digisafe_session. It keeps you signed in for up to 30 days. It is strictly necessary, can’t be read by scripts on the page, and is removed when you sign out. If you turn on two-step sign-in, two more cookies of the same kind are used only while signing in: one holds your sign-in for the few minutes it takes to type the code, and one remembers a device you chose to trust, for up to 30 days.

We don’t use advertising, analytics or tracking tools, and we don’t load scripts, fonts or images from other companies. Your settings (such as theme and font) are saved in your own browser, not sent to us.

• To create your account, sign you in and keep your session secure.
• To store your encrypted data and keep it in sync across your devices.
• To send emails you need: your sign-up code, a welcome email, email confirmation, password reset links, and a notice if someone tries to sign up with your address.
• To send product news, only if you ticked the box for it. It is never pre-ticked.
• To run share links and family folders when you use them.
• To prevent abuse, investigate problems and keep the service safe.
• To keep a record of your consent, and to meet legal duties.

We don’t sell your information, use it for advertising, or build profiles about you.

We use a small number of service providers, who handle data only to run the service for us:

• Supabase hosts our database and file storage in Tokyo, Japan. It holds your encrypted data and the readable account records described above.
• Vercel runs the app’s website and servers. Requests pass through its network, which may handle them in more than one country.
• Our email delivery provider sends account emails. It receives your name, email address and the content of the email.
• Your browser’s notification service (Google for Chrome and Android, Apple for Safari, Mozilla for Firefox, Microsoft for Edge) delivers notifications, if you turn them on. Each message is encrypted for your device on the way, so it can’t read them; it sees only that a message was sent to your device and when.

We may also share information if the law requires it, for example a valid court order. Even then, we can only hand over what we can read: we can’t decrypt your documents or your profile for anyone.

If DigiSafe or Kavion Solutions is ever reorganised or sold, your information may move to the new owner, who must keep protecting it as this policy describes.

Your encrypted data and your account records are stored in Japan (Tokyo). This means your information is transferred to and stored in Japan, whichever country you live in. Parts of it may also pass through other countries while our providers deliver the service, such as the United States.

The privacy laws in those countries may differ from yours. Where your law asks for extra safeguards when data leaves your country, we rely on the protections it allows, such as contract terms with our providers. Most of what is transferred is encrypted before it leaves your device.

• Your account and vault: until you delete your account.
• Sessions: up to 30 days, or until you sign out.
• Sign-up codes: they stop working after 10 minutes.
• Deleted folders and documents: their stored files are removed when you delete them. A small encrypted marker stays so your other devices hear about it, and is cleaned up after 90 days.
• Abuse protection counts: short-lived. Counts older than a day are cleared regularly.
• Share links: a link lasts at most 7 days. Expired links, their files and the times they were opened are removed automatically.
• Emergency card: until you turn it off or delete it, or delete your account. Turning it off removes the copy others can open; deleting it removes your copy too.
• Nominee access: until you remove your nominee or delete your account. Removing or changing your nominee deletes the copies and their keys. If you delete your account, your nominee setup, its copies and its history are deleted too; if your nominee deletes theirs, their access is removed and you’re asked to choose someone else.
• Referral points history: with your account, until you delete it.
• Referral email fingerprints: kept after the account is deleted, only so the same email address can’t be rewarded twice.
• After you delete your account: removed from our live systems straight away (see below). Copies in our hosting provider’s routine backups may last a limited time until those backups are replaced.

See and download your data

In Account, use Download all my data. It builds one file on your device with your documents in their original format, your folder and document details, your profile, and your account and consent details.

Correct your data

You can rename folders and documents, and change your profile answers such as your countries, in the app. For anything you can’t change yourself, such as your name or email address, email kavionsolutions13@gmail.com.

Delete your account

In Account, choose Delete account and confirm with your password. It happens straight away and can’t be undone. We remove:

• your account, sessions, sign-in records and consent records;
• your vault: the locked keys, PIN check and profile;
• all your folders, documents and their stored files;
• your share links and their files;
• your emergency card, so its QR code stops working;
• family folders you own, with their files, and your place in other people’s.

Documents you added to someone else’s family folder stay in that folder for its other members. The device you delete from is cleared at once. Your other devices are signed out the next time they connect, but copies saved on them stay there, encrypted, until you clear the app’s data on each one.

Product emails

Product emails are optional. You can withdraw that consent at any time, and it won’t affect your account. To stop them, turn off Product update emails in Account, under Privacy. It takes effect straight away.

Questions and complaints

If you are unhappy with how we handle your information, please email kavionsolutions13@gmail.com first so we can put it right. You can also complain to the privacy regulator where you live (see the country details below).

Beyond encryption on your device, we use HTTPS everywhere, store passwords, codes and session tokens only as hashes, limit repeated attempts, lock the vault automatically after a period you choose, and use strict browser security rules that block content from other websites.

No system is perfectly secure. If a security incident affects your information, we will tell you and the relevant authorities where the law requires it.

DigiSafe is only for people aged 18 or older, and you confirm this when you sign up. We don’t knowingly hold information about children. If you believe a child has an account, email kavionsolutions13@gmail.com and we will delete it.

This section sums up, for people in India, how we handle personal data under the Digital Personal Data Protection Act, 2023. Kavion Solutions is the Data Fiduciary, and you are the Data Principal.

What we process, and why

• Account details (name, email, sign-in and consent records): to create your account, sign you in, keep it secure and send the emails you need.
• Encrypted data (documents, folders, profile, reminders, emergency card): only to store it and keep it in sync between your devices. We can’t read it.
• Technical and abuse-protection records (hashed counts, short-term logs): to keep the service safe and fix problems.
• Product emails: only if you said yes, and you can stop them at any time.

We process this data because you asked us to provide DigiSafe and agreed to this policy, and where the law requires it. We don’t sell it, use it for advertising, or ask for your Aadhaar number.

Your rights

• Access: a summary of the personal data we process and how. Most of it you can download yourself with Download all my data in Account.
• Correction and completion: change most details in the app, and ask us for the rest.
• Erasure: delete your account in Account at any time. It takes effect straight away.
• Withdraw consent: as easily as you gave it, for example by turning off product emails or deleting your account.
• Nominate someone: to use these rights for you if you die or can’t act yourself.
• Grievance: complain to our Grievance Officer (below), and if you are not satisfied with the answer, to the Data Protection Board of India.

Grievance Officer

If something goes wrong

If a personal data breach affects you, we will tell you without delay, in plain words: what happened, what it may mean for you, what we are doing about it and what you can do. We will also report it to the Data Protection Board of India as the law requires. Because your documents are encrypted on your device, a breach of our servers would not reveal them.

How long we keep it

Your account and encrypted data are kept until you delete your account, and removed from our live systems straight away when you do. Short-lived records (sessions, sign-up codes, abuse-protection counts and share links) expire on their own. The full list is under How long we keep it.

DigiSafe is used in India, the United Kingdom, the United States, Canada and Australia. These extra details apply depending on where you live.

When we change this policy, we update the date at the top. If a change matters to how your information is handled, the app will ask you to read and agree to the new version before you carry on.

DigiSafe is run by Kavion Solutions. To ask a question, use a right, or make a complaint, email kavionsolutions13@gmail.com.

Many requests are quickest in the app itself: Download all my data and Delete account are both in Account.