PRIVACY · v2026.01 · UPDATED 2026-01-14
Email, billing identity, device public keys, region preference, account.country_code (sourced from App Store storefront → Play regionCode → Cloudflare CF-IPCountry → user-declared; XX fallback; Tor → T1). For Drive, Mail, and ticket bodies we hold ciphertext encrypted at rest: each object is encrypted under its own key, and that key is wrapped by a server-held master key. Vault items stay on your device.
Vault items are encrypted with a key derived on-device from your master password — we receive ciphertext only and cannot decrypt them. This is the one surface where the zero-knowledge claim holds (ADR-0068).
For Drive, Mail, ticket bodies, and any other content we hold for you, an admin read is technically possible. We gate every read on a dual-key ceremony and a PII redactor, and we record every access in the immutable audit log. We are a server-trust SaaS, not zero-knowledge (ADR-0069).
Connection counters per region: 14 days. Billing records: 7 years (statutory). Crash logs: 30 days, scrubbed. Lawful-intercept records: 30 days from the closure of the order, then destroyed.
US bare metal, primary in San Jose and Ashburn. EU mirrors in Frankfurt and Amsterdam for EU residents. RAM-only tunnel servers. Backups encrypted, off-prem. We run no workloads on public cloud.
Disclosed in our live transparency counter. Total served / produced / under seal: 0 / 0 / 0 as of 2026-04-28.
Article 15 signed export (everything we hold for you). Article 17 erasure cascade (delete pulls every plugin's state of you). Portability, complaint to your DPA. Self-serve from Settings → Account.
Some features may be unavailable in your country per local regulation. Foundational surfaces (auth / billing / support / audit) are always on; pluginable features (VPN / eSIM / Drive / Mail / Vault / Identity / Agents) follow the per-country availability matrix in your app.
Bayria, Inc. (San Francisco, CA) can be compelled by a US court of competent jurisdiction — or, for EU users, via MLAT — to enable per-account logging on a named user. For the named account only and for the duration of the order we may capture: VPN destination IPs, DNS queries, request and response headers, request bodies, and Drive / Mail object plaintext (decrypted server-side with our master key per ADR-0069). Vault items remain end-to-end encrypted and outside this capability. Every read is dual-key-gated, PII-redacted, and recorded in the immutable audit log; counts are published in the