Privacy Policy

1. Purposes of processing

• Account identification and authentication — identifying accounts by email address and signing you in with one-time magic links.
• Keeping you signed in — maintaining sessions with session tokens.
• Providing the service and proving integrity — team sharing, device registration and revocation, and signature verification that protects the audit history from tampering.
• Billing — creating and maintaining a paid subscription when you choose the Pro plan.
• Support and notices — answering inquiries and sending service announcements.

2. Personal data processed in identifiable form

• Email address — account identification and magic-link delivery (users.email, magic_tokens.email).
• Name (optional) — only if you enter one (users.name).
• Session token — a random token that keeps you signed in; not a password (sessions.token).
• Device public keys and labels — public keys used to verify signatures, never private keys (devices.pubkey_jwk, devices.label).
• Group membership and roles — which user holds which role in which group (memberships).
• Signed audit events — who, on which device, at what time, performed what action (events.payload_json and related columns).
• Request IP address — recorded by the server alongside audit and account events as the fourth audit factor, and used as the identifier for automated request throttling (events.ip, account_events.ip, rate_limits.key).
• View notifications — which member opened an item you created, stored as identifiers only and never as item names or contents (notifications).
• Subscription metadata — for paid plans, the customer and subscription identifiers issued by the payment processor plus status, billing cycle, and seat count. No card details are included (pro_subscriptions).
• Service error diagnostics — when a server error occurs, the path, method, and time of that request and the error details. Randomly issued user and group identifiers may appear; email addresses, tokens, keys, and password-like values are removed automatically before anything is recorded, and the request IP is not recorded (Cloudflare Workers Logs, an infrastructure log rather than the database).

3. Data held only as ciphertext, which the operator cannot decrypt

• Vault items — resource name, account ID, password, host address, and notes, all encrypted (items.ciphertext).
• Group names — encrypted (groups.name_enc).
• Sealed private-key blob — openable only with your master password (key_blobs.blob).
• Wrapped group keys — symmetric keys wrapped to each member's public key (wrapped_group_keys.wrapped_key).
• Recovery key blob — a second sealed copy of your private key, openable only with your recovery key (recovery_key_blobs.blob).

4. Data never collected

• Your master password — it never leaves your device. For new-device sign-in, the server stores a hash of a separately derived one-way authentication key and its KDF salt; neither can decrypt the vault.
• Vault plaintext and private decryption keys — these do not exist on the server.

5. Retention

• Magic-link tokens — expire 15 minutes after issue and are consumed on first use.
• Session tokens — expire 30 days after issue, or immediately when you revoke the device.
• Account data and encrypted vault data — retained until you delete your account, then destroyed without delay.
• Audit and account events, including the request IP — kept for as long as the group exists, on every plan. Audit events form a signed hash chain, so removing older entries would make integrity verification impossible for the remaining members. What the plan limits is not retention but how far back you can browse and export (30 days on the free plan, the full history on Pro). Deleting your account deletes your account events with it.
• Payment and transaction records — retained as required by the Korean Act on Consumer Protection in Electronic Commerce: five years for contract and withdrawal-of-subscription records, five years for payment and supply records, and three years for consumer complaint and dispute records. During those periods the records are kept separately, even after account deletion, and are not used for any other purpose.
• Service error diagnostics — deleted automatically no later than 7 days after they are recorded, and used only to find the cause of errors and respond to outages.

6. Processors and international transfers

The operator does not sell or otherwise provide your personal data to third parties. The following processing is entrusted to service providers, with the safeguards required by the Personal Information Protection Act written into each contract.

7. Security measures

• End-to-end encryption — vault items, group names, and private keys are encrypted on your device and the server holds no decryption key (AES-256-GCM for items, ECDH P-256 with HKDF-SHA256 for group-key wrapping, Argon2id key derivation from the master password).
• No master password on the server — the service does not transmit or store the master password in any form, which exceeds the one-way storage requirement that the Personal Information Protection Act enforcement decree applies to user passwords.
• Signature-based integrity — the change history is protected by device signatures (ECDSA P-256) and a hash chain.
• Encryption in transit (TLS), access control, and access logging, alongside the other administrative and technical safeguards required by law.

8. Your rights

You may request access, correction, deletion, or suspension of processing at any time. Because the operator cannot decrypt ciphertext items such as your stored passwords, you read and correct their content yourself on your own device, and the operator can only delete the ciphertext record. Requests can be sent to [email protected].

9. Privacy officer and remedies

You may also report privacy concerns to the Korea Internet & Security Agency privacy centre (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (1301), or the National Police Agency (182).

10. Cookies and local storage

The service stores a session cookie in your browser to keep you signed in. That cookie is HttpOnly, so scripts cannot read it, and is restricted to same-site requests. A companion security cookie protects against forged requests (CSRF). Your browser's local storage additionally holds your language preference and a short-lived sign-up marker. You can delete all of these in your browser settings, which signs you out. No advertising or tracking cookies are used.

11. Destruction of personal data

Personal data is destroyed without delay once its retention period has passed or its purpose has been achieved. Electronic files are deleted so that they cannot be recovered or reconstructed, and records kept separately under a legal obligation are not used for any other purpose.

12. Changes to this policy

This policy applies from the effective date below. Any addition, deletion, or amendment is announced at least 7 days in advance, or 30 days in advance for material changes.

• Published: [to be completed: publication date] / Effective: [to be completed: effective date]
• Trade name: unbundio
• Business registration number: [to be completed: business registration number]
• Address: [to be completed: registered business address]