Privacy Policy

Last updated 11 September 2026

Parivault stores documents that matter — insurance policies, bank details, investment records, property papers — and delivers them to people you choose if you stop checking in. That only works if you can trust how the data is handled. This page explains exactly what happens to it.

The short version. Your vault is encrypted on your own device before it is uploaded, and nobody at Parivault reads it. But we are not going to tell you we cannot: to deliver your documents after you are gone, we have to be able to decrypt them without you, so we hold a copy of your key protected by a separate secret. Section 2 explains exactly what that means. We also hold ordinary account data — your email address, your receivers' names and email addresses, and check-in timestamps — because the service cannot function without them.

1. Who we are

Parivault is operated from India by its founder as an individual proprietor. For any privacy question, correction, complaint or data request, write to hello@parivault.in. That address is also our grievance contact under the Digital Personal Data Protection Act, 2023. We aim to respond within 7 days and will not take longer than 30.

2. How your vault is encrypted, and who can decrypt it

The contents of your vault — every note and uploaded file — are encrypted in your browser using AES-256-GCM before anything is sent to us. Your master password itself never reaches our servers, and we never store it.

Your vault has its own randomly generated data key. That key is what your entries are actually encrypted with. It is stored twice: once locked with the key your password produces on your device, which is how you open your vault, and once locked with a separate secret held outside the database, which is how we deliver your documents when you no longer can. That second copy means Parivault is technically able to decrypt your vault. We are telling you plainly because the alternative would be a lie, and because you should judge us on what the system actually does.

It works this way because it has to. The entire point of Parivault is that your documents reach your family when you are not there to hand over a password. A design where only you hold the key would mean that the moment you die, your vault becomes unopenable — which is exactly the problem you signed up to solve.

What we do with that ability, and what constrains it:

  • It is used in one place in the code — the delivery step, after your check-ins have been missed and the grace period has passed.
  • Nobody reads vault contents in the ordinary course of running the service. We do not index them, analyse them, train on them or show them to staff.
  • The key-protecting secret is held separately from the database, so a database breach alone does not expose vault contents.
  • Every decryption is written to an audit log against your account.
  • A court order compelling us to decrypt is something we could technically comply with. Any provider that can deliver your documents after your death is in this position, including every competitor we know of.

If that trade-off is not one you want to make, do not put your only copy of anything in here, and consider storing a password hint rather than the password itself.

Changing your password does not affect your entries. Your vault is encrypted with a data key that belongs to your account, not with your password. Your password only unlocks that data key. When you reset your password, the data key is re-locked under the new one and everything you stored stays readable.

3. What we do store

  • Account data: your name, email address, a one-way hash of your password, and optionally a phone number.
  • Receiver data: the names and email addresses of the people you nominate, so we can reach them if delivery is ever triggered.
  • Vault metadata: entry titles, categories, timestamps and file sizes. Titles are stored so you can find your own entries.
  • Encrypted blobs: the ciphertext of your notes and files. Meaningless without your key.
  • Check-in and delivery records: when you last checked in, reminders we sent, and whether they were delivered.

We do not run analytics over vault contents, we do not profile you, and we do not sell, rent or share personal data with anyone for their own marketing.

4. Why we hold it

Account and receiver data is processed to perform the service you signed up for. Check-in records exist to operate the dead man's switch — the entire product depends on knowing whether you checked in. Communication logs exist so that we, and you, can verify a reminder or a delivery actually went out.

5. Who processes data on our behalf

Parivault is built on third-party infrastructure. Each provider sees only what it needs, and none of them can decrypt your vault:

  • Vercel — application hosting and request logs.
  • MongoDB Atlas — the database holding account, receiver and metadata records.
  • Backblaze B2 — object storage for encrypted files, when you use Parivault Storage.
  • Google Drive— only if you explicitly connect it. Files then live in your own Drive's hidden application folder rather than ours.
  • Resend — transactional email (reset codes, check-in reminders, delivery notices).

Some of these providers operate servers outside India. Where that happens, data is transferred under the provider's standard contractual protections.

6. WhatsApp

Parivault is built to send check-in reminders over WhatsApp, but that channel is currently switched off. If and when it is enabled, your phone number would be shared with the messaging provider solely to deliver those messages, and this page will be updated before that happens.

7. Retention and deletion

We keep your data for as long as your account is open. You can delete individual vault entries at any time; deletion removes both the metadata record and the encrypted blob. If you want your whole account erased, email hello@parivault.in and we will delete it, along with your receivers and vault contents, within 30 days. Backups may retain residual copies for a short period before they roll over.

8. Your rights

Under the DPDP Act 2023 you may:

  • ask what personal data we hold about you and get a copy of it;
  • have inaccurate or incomplete data corrected;
  • have your data erased;
  • nominate someone to exercise these rights if you die or become incapacitated;
  • complain to us and, if unsatisfied, to the Data Protection Board of India.

All of these start with an email to the address above. We do not charge for any of them.

9. Security

Beyond client-side encryption, we use TLS for all traffic, store passwords only as bcrypt hashes, and keep infrastructure credentials out of the codebase. No system is perfect: if a breach ever affects your personal data, we will notify you and the Data Protection Board as required by law. Because vault contents are encrypted on your device, a breach of our storage would expose ciphertext, not documents.

10. Children

Parivault is not intended for anyone under 18 and we do not knowingly create accounts for minors.

11. Cookies and advertising

Inside the app we set a single session cookie so you stay signed in. There are no third-party trackers and no analytics running over your vault.

On our public marketing pages we may load an advertising pixel so we can tell which ads bring people to Parivault. It records that a visit or a sign-up happened — never who you are or what is in your vault — and it does not run on any signed-in page.

12. Changes

If this policy changes materially — a new processor, a new category of data, WhatsApp going live — we will update the date at the top and email you before the change takes effect.