Privacy Policy

Countervault · Effective November 4, 2026

This policy describes the current privately administered Countervault beta, including its Google Drive integration.

Information we use

We store your sign-in email, display name, account membership, session information, and records you choose to save. Saved records may include notes, uploaded original files, filenames, paths, dates, sizes, fingerprints, receipts, and sharing information. Authentication and operational records may include email delivery events and security/audit history. Hosting providers may process IP addresses, request information and service logs to operate and protect the service.

Google user data

Individual-file selection uses access to files you explicitly choose. Folder inventory uses read-only Drive metadata access, which technically permits metadata access across Drive; Countervault traverses the folder tree you choose. Browsing lists stay in browser memory. When you save an inventory, selected metadata, folder paths, provider identifiers and available fingerprints are sent to Countervault and stored in your private account. Drive file contents are not downloaded or stored by these inventory features.

The separate owner-only Drive administration tool requests permission to manage Drive files. It checks the connected Google account, reads live metadata, and sends selected trash/restore actions directly from your browser to Google. Trashing a folder affects its contents. Google access tokens stay in browser memory: Countervault does not send them to its API or persist them in its database or browser storage. Disconnecting clears the in-app token but does not revoke the Google authorization grant.

Payments

If you subscribe, Stripe processes your email, billing address, payment details and applicable tax information. Countervault stores Stripe customer and subscription identifiers, subscription status, the last paid period and the hosted-record deletion deadline. Card details are handled by Stripe rather than stored by Countervault. Deleting hosted records does not delete invoices or transaction records held by Stripe. See Stripe’s Privacy Policy.

Local files and optional text extraction

Local inventory reads chosen files in your browser to collect metadata and fingerprints. Optional supported-document text extraction runs locally. When you save such an inventory, extracted excerpts are stored privately along with its metadata. Inventorying does not upload the original files. Uploading files as evidence is a separate action that stores those original bytes on Countervault.

Use, sharing and service providers

We use data to provide the features you request, authenticate access, maintain records, and protect and troubleshoot the service. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. We do not provide an AI analysis service for your Drive data.

Countervault uses Railway for API/database hosting, Netlify for frontend hosting, and configured email delivery services for sign-in and invitations. Google processes Drive authorization and API actions. Data may be processed where these providers operate. Access to private account data is restricted by application permissions; necessary administrator access may occur for support, security, or legal obligations.

You control explicit sharing actions. A catalog share link exposes its frozen metadata snapshot to anyone with the link; extracted content is omitted from public catalog snapshots. Other sharing or verification features may expose the information shown in their previews. Recipients can retain copies after you revoke a link.

Optional blockchain timestamping

If you request timestamp anchoring, blinded cryptographic commitments are sent to public timestamp services and may be committed to Bitcoin. Original documents, notes, filenames, and raw inventory metadata are not sent to the blockchain. Public commitments cannot be removed by deleting your account.

Retention and deletion

Saved records and inventories are retained while your paid subscription continues, unless you remove them sooner. After your paid period ends, you have 30 days to download your records. Hosted originals, notes, receipts, inventories, scan history and shared snapshots are then deleted. Your account and minimal billing information remain so you can sign in or subscribe again. Resubscribing after deletion cannot recover deleted records. Beta accounts without paid subscription history are not placed on this cancellation schedule. Inventories can include earlier scan history. Revoking a share disables the link but retains its snapshot privately until the index is deleted. Removing an inventory entry or index does not delete the original Drive or local file. Trashing a Drive item is a separate explicit action; Google normally permanently deletes items after 30 days in Trash.

Disconnecting Google or removing authorization does not delete inventories previously saved in Countervault. You can revoke Countervault access at Google Account connections, and separately remove saved indexes or request account-data deletion. We do not promise immediate erasure from infrastructure logs or provider backups; copies already downloaded or shared and public timestamp commitments cannot be recalled.

Security and your choices

Account sessions protect private records, and network connections use HTTPS. No service can guarantee absolute security. Keep your own originals and exports. The beta is not designed for children under 18.

Google API Limited Use

Countervault's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Contact and updates

For privacy, deletion, or support requests, contact the Countervault administrator who invited you to this private beta. A public contact address will be listed here when configured.

Updates will be posted here with a revised effective date.