Legal

Privacy Policy

Last updated:  ·  Applies to filevault.works

FileVault is a secure file-sharing platform built for students and educators. This policy explains what information we collect, how we use it, and how we protect it. We keep it simple because we don't do anything complicated with your data.

1. Information We Collect

When you sign in with Google, we receive the following from your Google account:

• Your name and profile picture
• Your email address

We also collect:

• Files you upload and associated metadata (name, folder, size, description, expiry date)
• File download, view, and access activity (tracked per anonymous user key, not tied to your identity unless you are signed in)
• Emoji reactions and likes (👍) you add to files, stored against an anonymous local user key
• File requests you submit via the upload-request form (including your name, email, and the details of what you're requesting)
• Push notification subscription tokens (if you opt in)
• Your role (student, manager, or admin), stored in the user_profiles table
• Folder access and restriction grants — which folders you've been given or denied access to
• Ratings you give to files, stored separately from emoji reactions
• In-app notifications generated for your account (e.g. file request updates, expiry warnings), stored in our notifications table
• If you enable multi-factor authentication, your MFA enrollment status and recovery codes (recovery codes are stored hashed, not in plaintext)
• Messages you send to the AI chat assistant — these are passed to Groq's API to generate a response and are not stored by FileVault after the session ends

2. How We Use Your Information

• To authenticate you and grant access to the vault
• To display your name and profile picture within the app
• To manage and organise uploaded files
• To track how many students have viewed or downloaded each file (aggregate counts only — not a log of who viewed what)
• To store emoji reactions and likes you add to files
• To send push notifications about new uploads, fulfilled file requests, or files that are about to expire (only if you opt in)
• To process and respond to file requests submitted through the upload-request form
• To power the AI assistant, by forwarding your messages to Groq's API — see section 6 below
• To display your profile information on the profile page and allow you to delete your account

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.

3. Data Storage

Your data is stored securely using Supabase, which provides a Postgres database and file storage hosted on AWS infrastructure. Files are stored in a private Supabase Storage bucket and are only accessible through authenticated, signed URLs. The backend server runs on Render and does not persist any data independently — all persistent data lives in Supabase.

4. Push Notifications

If you enable push notifications, your browser's push subscription token is stored in our database. This token is used solely to deliver notifications from FileVault. You can revoke notification permissions at any time from your browser settings, and we will remove your token when it expires or becomes invalid. Tokens are also pruned automatically by a periodic server-side cleanup job.

5. Cookies & Local Storage

FileVault uses browser local storage and session storage to cache your session, app preferences, recently viewed files, search history, and folder sort settings. We do not use third-party tracking cookies or analytics services.

6. AI Assistant (Groq)

FileVault includes an AI chat assistant powered by Groq (Llama 3.1). When you send a message to the assistant, your message and the current conversation history are forwarded to Groq's API via our backend server to generate a response. FileVault does not store your chat history after your session ends. Separately, when the app generates a summary of your files, the relevant file names are sent to Groq's API for this purpose; file names may sometimes contain identifying information. Please refer to Groq's Privacy Policy for details on how they handle data sent to their API.

7. Data Retention

Your account data is retained as long as you have an active account. Uploaded files may be subject to expiry dates set by managers, after which they are automatically removed. Emoji reactions and view counts associated with deleted files may remain in the database briefly before being cleaned up. You may request deletion of your account and all associated data at any time — see section 8 below.

8. Your Rights & Account Deletion

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Permanently delete your account and associated data — you can do this directly from your Profile page using the "Delete Account" option in the Danger Zone
• Withdraw consent for push notifications at any time via your browser settings

When you delete your account, we remove your auth record, download history, file requests, and any uploaded avatars. Reactions and anonymous view records keyed to your local user key are not automatically removed, as they are not linked to your identity.

9. Security

We take reasonable technical measures to protect your data, including encrypted storage, authenticated access, row-level security policies on our database, and role-based access control enforced via authenticated session tokens for manager- and admin-only functionality. Select internal/automated endpoints use server-side secret validation. No system is perfectly secure, and we cannot guarantee absolute security.

10. Children's Privacy

FileVault is intended for use by university students and educators. We do not knowingly collect data from anyone under the age of 13.

11. Changes to This Policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. Continued use of FileVault after changes constitutes acceptance of the updated policy.