Privacy Policy

Last updated: March 19, 2026

1. Who We Are

Sifero Cloud ("we", "us") operates the cloud storage service at sifero.cloud. Our servers are located in secure data centers worldwide. We comply with applicable data protection laws including GDPR for users in the EU/EEA.

2. What We Collect

Data we store:

DATA	PURPOSE	ENCRYPTED?
Username	Authentication	No (plaintext)
Password hash	Authentication	Argon2id (irreversible)
IP address at login	Security, brute-force protection	No
File metadata (size, date)	Storage quota, TTL auto-delete	No - server inherently sees file size and upload time. This is a technical limitation of any cloud service.
File names	Display	Yes (AES-256-GCM, client-side)
File contents	Storage	Yes (AES-256-GCM, client-side)
Notes	Storage	Yes (AES-256-GCM, client-side)
Chat messages	Communication	Yes (AES-256-GCM, client-side)
Search index	Content search	Yes (AES-256-GCM, client-side)

Data we do NOT collect:

• Email addresses
• Phone numbers
• Real names or identity documents
• Payment information (payments not yet implemented)
• Browser fingerprints or tracking cookies
• Usage analytics or telemetry

3. Zero-Knowledge Architecture

All encryption occurs in your browser before data reaches our servers. Your password is used to derive an encryption key via PBKDF2 (600,000 iterations). We never receive, store, or have access to your password or encryption keys.

Consequence: if you forget your password, we cannot recover your data. It is permanently lost.

Our encryption module is open-source and available for audit at github.com/sifero-cloud/crypto.

4. How We Use Your Data

• Authentication - verifying your identity when you log in
• Security - detecting brute-force attacks and unauthorized access
• Service operation - storing and serving your encrypted files
• Support - responding to your support requests

We do not use your data for advertising, profiling, analytics, or any purpose other than providing the service.

5. Data Sharing

We do not sell, rent, or share your data with any third party. We do not have advertising partners. We do not use analytics services.

We may be compelled by applicable law to provide data in response to a valid court order. In such cases, we can only provide encrypted blobs that we cannot decrypt. Our Warrant Canary system is designed to indirectly notify you if such a request occurs.

6. Data Storage and Security

• Servers: Secure data centers (multiple regions)
• File storage: Encrypted object storage (multiple regions)
• All data is encrypted client-side before reaching any server. Server location is irrelevant to security - data is unreadable without your password regardless of where it is stored
• Transport encryption: TLS 1.3
• Storage encryption: AES-256-GCM (client-side)
• Server password hashing: Argon2id
• Client-side key derivation: PBKDF2-HMAC-SHA256 (600,000 iterations)
• Security headers: HSTS, CSP, X-Frame-Options, nosniff

7. Data Retention

• Account data: retained until you delete your account
• Files: retained until you delete them, or until TTL/burn-after-read triggers
• Security logs (IP, login attempts): retained for 90 days
• Support messages: retained until you delete your account

8. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access - request a copy of data we hold about you
• Rectification - correct inaccurate data
• Erasure - delete your account and all associated data
• Data portability - export your data (Cloud on USB feature)
• Object - object to data processing
• Complaint - file a complaint with your local data protection authority

To exercise these rights, contact us through the in-app Support chat.

9. Cookies and Local Storage

We use browser localStorage to store your authentication token and theme/language preferences. We do not use tracking cookies, third-party cookies, or any analytics scripts.

10. Children

Sifero Cloud is not intended for children under 13 years of age. We do not knowingly collect data from children.

11. Changes

We may update this policy. Significant changes will be communicated through the service. Continued use after changes constitutes acceptance.

12. Contact

Data Controller: Sifero Cloud
Location: Global
Support: In-app support chat
Supervisory Authority: Your local data protection authority