GDPR & data requests

No secrets or confidential vault content are ever stored readable on our servers

This is the most important guarantee on this page, so it's stated plainly: every secret and every document you save - anywhere in your vault, whether created internally or received through a share - is encrypted inside your own browser before it's ever sent to us. Our servers and database only ever hold ciphertext - ourselves included, nobody at GoSecretly can read the contents of your vault, and we have no technical means to decrypt it, not even under a court order or in the event of a full database compromise. The decryption key is derived from your organization's recovery key, generated in your browser and shown to you once - we never receive or store it.

Who's responsible for your data

For your account information (name, email, organization details, activity logs) GoSecretly acts as the data controller. For the secret and document content stored in your organization's vault, we're closer to a processor with no practical access - everything is encrypted in your browser before it reaches us, and we never hold the key needed to read it, as described above. See our privacy policy for the full detail on that design.

What we hold, and for how long

These are the actual, enforced retention periods - not aspirational targets:

• Account data (name, email, organization membership) - kept for as long as your account is active. An account with nobody logging in for 12 months gets a warning email, and if still untouched 30 days later, becomes eligible for closure - see “Automatic closure of inactive accounts” below.
• Secret and document content - encrypted client-side, stored as ciphertext we cannot read. One-time-view secrets/documents are deleted the moment they're viewed and confirmed (or when their link expires, whichever comes first); anything explicitly saved to your organization's vault is kept until you delete it or your account closes.
• Audit logs (who did what, when - metadata only, never secret content) - retention depends on your plan: not available on Free, 30 days on Solo, 90 days on Team, and 12 months on Business and Agency (accounts predating paid plans keep their original 24-month retention permanently). See pricing for details. Automatically purged once past the applicable window.
• Application error/diagnostic logs - kept for 90 days, then automatically purged.
• Page-view analytics (which pages were visited - no IP address or identifying data attached) - kept for 12 months, then automatically purged.
• Delivery/notification records (e.g. that a share-link email was sent) - kept for 90 days after completion, then automatically purged.

Automatic closure of inactive accounts

If nobody in your organization logs in for 12 months, every admin gets a warning email. Logging back in at any point during the following 30 days cancels this automatically - nothing else needs to happen. If nobody logs in during that window, the organization becomes eligible for closure, which a member of our team then reviews and completes manually (never automatically) - see “Your right to erasure” below for exactly what that involves.

Your rights under UK GDPR

• Right of access - ask what personal data we hold about you. Contact us and we'll respond within one month.
• Right to rectification - your name, phone number, and address are editable directly from your profile page at any time; email changes go through support.
• Right to erasure - self-service, from your profile page's “Danger zone”: request account destruction, confirmed with a two-factor code. This anonymizes your name, email, phone, and address rather than deleting the row outright, so security/audit history stays intact without being linked back to you - the same outcome the law requires, without breaking records other people may legitimately still need. If you're the sole remaining admin of your organization, this closes the whole organization: every user is anonymized and every secret and document permanently deleted. A request only takes effect once a member of our team reviews and completes it - you can cancel it yourself at any point before then.
• Right to data portability - your profile fields (name, phone, address) can be requested via support. We cannot export the plaintext content of secrets or documents ourselves under any circumstances - our zero-knowledge design means only your own browser, with your organization's recovery key, can ever decrypt them.
• Right to object / restrict processing - contact us and we'll work through it with you.

International transfers

Our primary infrastructure (file storage and, in production, email delivery) is hosted in the EU (Ireland). A small number of infrastructure providers we rely on for anti-abuse and account security are based outside the UK/EEA; where that's the case, we rely on their own standard safeguards (such as standard contractual clauses) for the transfer.

Questions or complaints

For any question about this page, or to make a request, contact us. If you're not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).