Privacy Policy

At Enbox, privacy is the product. This policy explains what data we process, why, and the strict limits we place on ourselves. It applies to enbox.me and all Enbox apps.

Our core principle

Your content is end-to-end encrypted. It is encrypted on your device with keys derived from your master password before it ever reaches our servers.

We cannot read your email, files, photos, passwords or messages. Not for advertising, not for “improving the product”, not on request. We never have the keys.

Data we process

To run the service we process a small amount of data:

We do not process:

• The contents of your mail, files, photos or vault (we only ever see ciphertext)
• Advertising or tracking identifiers
• Data brokered from third parties

How we use data

1. To provide and sync the service across your devices
2. To process payments through our payment provider
3. To detect abuse, fraud and security incidents
4. To send you essential account and security notices

We never sell your data, and we never use it to build advertising profiles.

Data retention

We keep your encrypted content for as long as your account is active. When you delete your account, your data is permanently removed within 30 days. Technical logs are retained for up to 90 days for security purposes.

Your rights

You can, at any time:

• Export all of your data in standard formats
• Delete your account and everything in it
• Request a copy of the account data we hold

To exercise any right, email privacy@enbox.me.

Sub-processors

We use a small number of vetted providers (cloud hosting, payment processing) that never receive your decryption keys. A current list is available on request.

Changes to this policy

If we make material changes we will notify you by email and update the date at the top of this page.

Questions? Write to privacy@enbox.me.